LiteLLM Release Pipeline Hijacked Again, GitHub Package Firewall, PHP2Shell Core RCEs & eMudhra CA Keys Compromised

This week on Ship It Weekly, LiteLLM's release pipeline was hijacked again: stolen GitHub CLI tokens from three engineers changed the pipeline, kicked off the release and approved it, and a credential-stealing 1.107.0 went out to PyPI and Docker Hub. GitHub put a package firewall into public preview, with advisory and supply chain checks and a cooldown for new releases. PHP fixed PHP2Shell, two critical core runtime bugs (CVE-2026-109618 and CVE-2026-109619) that someone tried to exploit four days before disclosure. And eMudhra, a certificate authority in India, found out the private keys for eight intermediate certificates could be worked out from its own public certificates.

The thread: most of this came through things you depend on but don't run. A library's release pipeline, the registry you pull from, the runtime under your app, and the trust store in your images.

In the lightning round: another GitLab CVSS 10 (CVE-2026-110264), Google's report on the europe-west2 London outage, AWS taking its European Sovereign Cloud off the global backbone on October 24, and a GitHub audit log change that can quietly break SIEM rules.

The human closer, from Brent Chapman: page on what users actually do. Your users don't care how your machines feel. They care whether they can log in.

On Monday, Jinger Meilani joins me to talk about running retros like a tabletop RPG.

Highlights

• LiteLLM 1.107.0: two stolen identities passed a two-person approval

• GitHub package firewall: advisories, attestations and a cooldown

• PHP2Shell: an exploit attempt four days before disclosure

• Patching PHP is easy, finding all of it is hard

• eMudhra: CA private keys worked out from public certificates

• Page on what users feel, not how the machine feels

Links

LiteLLM 1.107.0 compromise (Wiz): https://tsn.io/yQtmu

GitHub package firewall in public preview: https://tsn.io/QjofJ

PHP2Shell, CVE-2026-109618 and CVE-2026-109619 (Help Net Security): https://tsn.io/GUyop

Eight eMudhra CA keys compromised (The Hacker News): https://tsn.io/K2jqM

GitLab 19.5.1 patch release: https://tsn.io/0wsPX

Google Cloud europe-west2 incident report: https://tsn.io/nVk2N

AWS European Sovereign Cloud independent operation: https://tsn.io/gKnQl

GitHub secret scanning updates: https://tsn.io/JDGmT

Stop paging on how your machines feel (Brent Chapman): https://tsn.io/MAItM

SRE Weekly #539: https://tsn.io/XAsKz

This week's On Call Brief: https://tsn.io/nBAVg

More episodes and show notes: https://tsn.io/NqkdP

On Call Brief: https://tsn.io/Gpz2d

LMGT Awards: https://tsn.io/lAERA