LiteLLM Release Pipeline Hijacked Again, GitHub Package Firewall, PHP2Shell Core RCEs & eMudhra CA Keys Compromised

This week on Ship It Weekly, LiteLLM's release pipeline was hijacked again: stolen GitHub CLI tokens from three engineers changed the pipeline, kicked off the release and approved it, and a credential-stealing 1.107.0 went out to PyPI and Docker Hub. GitHub put a package firewall into public preview, with advisory and supply chain checks and a cooldown for new releases. PHP fixed PHP2Shell, two critical core runtime bugs (CVE-2026-109618 and CVE-2026-109619) that someone tried to exploit four days before disclosure. And eMudhra, a certificate authority in India, found out the private keys for eight intermediate certificates could be worked out from its own public certificates.The thread: most of this came through things you depend on but don't run. A library's release pipeline, the registry you pull from, the runtime under your app, and the trust store in your images.In the lightning round: another GitLab CVSS 10 (CVE-2026-110264), Google's report on the europe-west2 London outage, AWS taking its European Sovereign Cloud off the global backbone on October 24, and a GitHub audit log change that can quietly break SIEM rules.The human closer, from Brent Chapman: page on what users actually do. Your users don't care how your machines feel. They care whether they can log in.On Monday, Jinger Meilani joins me to talk about running retros like a tabletop RPG.Highlights• LiteLLM 1.107.0: two stolen identities passed a two-person approval• GitHub package firewall: advisories, attestations and a cooldown• PHP2Shell: an exploit attempt four days before disclosure• Patching PHP is easy, finding all of it is hard• eMudhra: CA private keys worked out from public certificates• Page on what users feel, not how the machine feelsLinksLiteLLM 1.107.0 compromise (Wiz): https://tsn.io/yQtmuGitHub package firewall in public preview: https://tsn.io/QjofJPHP2Shell, CVE-2026-109618 and CVE-2026-109619 (Help Net Security): https://tsn.io/GUyopEight eMudhra CA keys compromised (The Hacker News): https://tsn.io/K2jqMGitLab 19.5.1 patch release: https://tsn.io/0wsPXGoogle Cloud europe-west2 incident report: https://tsn.io/nVk2NAWS European Sovereign Cloud independent operation: https://tsn.io/gKnQlGitHub secret scanning updates: https://tsn.io/JDGmTStop paging on how your machines feel (Brent Chapman): https://tsn.io/MAItMSRE Weekly #539: https://tsn.io/XAsKzThis week's On Call Brief: https://tsn.io/nBAVgMore episodes and show notes: https://tsn.io/NqkdPOn Call Brief: https://tsn.io/Gpz2dLMGT Awards: https://tsn.io/lAERA