It could be. Particularly of the foreign government, but also of the supposed target especially if security of the kind that was claimed to be compromised is key to their business reputation.
Well, yes, you can sue for anything. The barrier here isn't that publishing that a firm is subject to an exploit is specially categorically immune from defamation liability, but the regular standards for defamation, which in the US include falsity, a certain measure of responsibility for the falsity (which carries based on whether public figure or a matter of public interest are involved), and actually damaging publication.
I'm not sure defamation is the right word here—"X was attacked by a foreign government" isn't defamation.