But I don't see where it discusses sending PRs to affected repos, only detecting them.
Ah yeah I had the old link, thanks for fixing. Actually we privately disclosure the problem to the developers and get it fixed following responsible disclosure and not post PRs directly.