damienwebdev

I don't have an exact count, but during my analysis, I found that ~40 of the top 100 starred repos in the PHP ecosystem were impacted. Primarily by jobs that run `on: schedule` or by a maintainer with an `on: push`

After yesterday's composer situation, I felt the need to write down my perspective on how this came to be as the vulnerability reporter.

It's a mix of responsibility between both systems. A new format combined with an old "bug".

I was the reporter on this one. If you have Github Actions in your organization, disable them immediately if you're unsure which version of composer your Github Actions run.

I'd like to think that I'm a somewhat "odd" person, but I'm not exactly sure how that reflects in my code. This code hasn't been taken over, it's just been something I've been working on a long time.

Just following up that I've fixed this!