Bash gets shellshocked

Isn't Linux Foundation's Core Infrastructure Initiative supposed to do this kind of inventory now? Or is it just another corporate smokescreen pouring oil on the waves, that will make reassuring noises but won't be proactive (ie. won't go looking for trouble).