Instead of fixing the source code, it appears that the company's developers made a series of careful changes directly to the buggy program's executable file. Bug CVE-2017-11882 is a buffer ...

Open source software used by more than 23,000 organizations, some of them in large enterprises ... the source code for all versions of tj-actions/changed-files received unauthorized updates ...

Many of the companies that were attacked used the same source-code management system made by Perforce, a California-based company that makes products used by many large companies. McAfee's white ...