We have fixed a counterfeiting vulnerability that affected Zcash prior to the Sapling network update. We have published a blog post with more detail. There is no evidence of exploitation. Users need take no action. We have raised CVE-2019-7167 for this issue.