(how did they fix it so fast?)
Comex explains:
QUOTE(comex @ Oct 1 2009, 08:13 PM) Actually, they didn't even try to fix the actual exploit. The only change was that the size of banners in saved channels is now limited to 100 kilobytes. After several months, that's their "fix". Still, it means that the 400kish nop sled in bannerbomb can't fit anymore; I think the SD menu is somewhat more reliable than data management with respect to memory addresses, but not sure yet.
http://en.wikipedia.org/wiki/NOP_slide