LiteLLM Release Pipeline Hijacked Again, GitHub Package Firewall, PHP2Shell Core RCEs & eMudhra CA Keys Compromised

This week on Ship It Weekly, LiteLLM's release pipeline was hijacked again: stolen GitHub CLI tokens from three engineers changed the pipeline, kicked off the release and approved it, and a credential-stealing 1.107.0 went out to PyPI and Docker Hub. GitHub put a package firewall into public preview, with advisory and supply chain checks and a cooldown for new releases. PHP fixed PHP2Shell, two critical core runtime bugs (CVE-2026-109618 and CVE-2026-109619) that someone tried to exploit four days before disclosure. And eMudhra, a certificate authority in India, found out the private keys for eight intermediate certificates could be worked out from its own public certificates. The thread: most of this came through things you depend on but don't run. A library's release pipeline, the registry you pull from, the runtime under your app, and the trust store in your images. In the lightning round: another GitLab CVSS 10 (CVE-2026-110264), Google's report on the europe-west2 London outage, AWS taking its European Sovereign Cloud off the global backbone on October 24, and a GitHub audit log change that can quietly break SIEM rules. The human closer, from Brent Chapman: page on what users actually do. Your users don't care how your machines feel. They care whether they can log in. On Monday, Jinger Meilani joins me to talk about running retros like a tabletop RPG. Highlights • LiteLLM 1.107.0: two stolen identities passed a two-person approval • GitHub package firewall: advisories, attestations and a cooldown • PHP2Shell: an exploit attempt four days before disclosure • Patching PHP is easy, finding all of it is hard • eMudhra: CA private keys worked out from public certificates • Page on what users feel, not how the machine feels Links LiteLLM 1.107.0 compromise (Wiz): https://tsn.io/yQtmu GitHub package firewall in public preview: https://tsn.io/QjofJ PHP2Shell, CVE-2026-109618 and CVE-2026-109619 (Help Net Security): https://tsn.io/GUyop Eight eMudhra CA keys compromised (The Hacker News): https://tsn.io/K2jqM GitLab 19.5.1 patch release: https://tsn.io/0wsPX Google Cloud europe-west2 incident report: https://tsn.io/nVk2N AWS European Sovereign Cloud independent operation: https://tsn.io/gKnQl GitHub secret scanning updates: https://tsn.io/JDGmT Stop paging on how your machines feel (Brent Chapman): https://tsn.io/MAItM SRE Weekly #539: https://tsn.io/XAsKz This week's On Call Brief: https://tsn.io/nBAVg More episodes and show notes: https://tsn.io/NqkdP On Call Brief: https://tsn.io/Gpz2d LMGT Awards: https://tsn.io/lAERA