LiteLLM Release Pipeline Hijacked Again, GitHub Package Firewall, PHP2Shell Core RCEs & eMudhra CA Keys Compromised

Podcast: Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News · Teller's Tech - DevOps, SRE and Cloud Podcast

Opublikowano: 2026-10-24

This week on Ship It Weekly, LiteLLM's release pipeline was hijacked again: stolen GitHub CLI tokens from three engineers changed the pipeline, kicked off the release and approved it, and a credential-stealing 1.107.0 went out to PyPI and Docker Hub. GitHub put a package firewall into public preview, with advisory and supply chain checks and a cooldown for new releases. PHP fixed PHP2Shell, two critical core runtime bugs (CVE-2026-109618 and CVE-2026-109619) that someone tried to exploit four days before disclosure. And eMudhra, a certificate authority in India, found out the private keys for eight intermediate certificates could...