Code-Injection Bugs Bite Google, Apache Open-Source GitHub Projects