This is not a vulnerability in SHA-256. See: https://en.wikipedia.org/wiki/One-way_compression_function#Davies.E2.80.93Meyer https://en.wikipedia.org/wiki/One-

This is not a vulnerability in SHA-256. See: https://en.wikipedia.org/wiki/One-way_compression_function#Davies.E2.80.93Meyer https://en.wikipedia.org/wiki/One-way_compression_function#D... "A notable property of the Davies–Meyer construction is that even if the underlying block cipher is totally secure, it is possible to compute fixed points for the construction" That is all that has been done here.