On Call Brief – Week of October 25–31, 2026

2026-10-25 — 2026-10-31 Briefing: 2026-10-25 Last updated 5 hours ago (Oct 27, 2026 3:51 am EDT) 17 min read
Share
Category:
Tags:

This week's top stories

1. LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials LiteLLM 1.107.0 on PyPI

  • Category: Community
  • What happened: The LiteLLM 1.107.0 package on PyPI and its Docker images were compromised through a lookalike source, allowing malicious Python startup hooks to steal cloud and AI tool credentials. This compromise involves a remote Python loader controlled by a GitHub-hosted file.
  • Worth reading: Upgrade to LiteLLM version 1.108.0 or later and audit your systems for any unauthorized credential access.
  • Source: CloudSecList
  • Tags:

2. The Pulse: Firebase’s global outage & poor response

  • Category: Deep Dive
  • What happened: Firebase experienced a global outage caused by a server-side data change that triggered crashes in client applications using the Firebase SDK. The server-side modification caused the SDK to fail on the client side, resulting in widespread application failures for services depending on Firebase. Google's incident response was criticized as inadequate and slow, drawing frustration from affected developers and operators. Operators who experienced crashes should review the Firebase blog for technical details about the root cause and monitor for SDK updates that may include additional resilience against similar server-side changes.
  • Takeaway: Review your dependency on Firebase and prepare for potential outages by implementing fallback mechanisms.
  • Sources: Blog Pragmaticengineer via SRE Weekly, Firebase Blog via SRE Weekly
  • Tags:

3. Is Railway Down? What the 21–22 October 2026 Railway Outage Means for Developers

  • Category: Deep Dive
  • What happened: Railway experienced a security incident on October 21-22, 2026 that resulted in service outages affecting builds and deployments, plus unauthorized access to environment variables in approximately 1.85% of customer workspaces. The breach also compromised connected GitHub accounts, potentially exposing code repositories where Railway had read and write access. Operators using Railway should rotate all environment variables stored in affected workspaces, revoke and regenerate any API keys or secrets that were stored there, and review GitHub repository access logs for suspicious activity during the incident window. Additionally, organizations should revoke Railway's GitHub OAuth application access and re-authorize with minimum necessary permissions, then audit any code changes made to connected repositories during the breach timeframe.
  • Takeaway: The outage impacted developers' ability to deploy applications, highlighting the importance of securing environment variables. Users should be aware of the need to rotate API tokens and monitor for any further updates from Railway regarding security measures.
  • Sources: dev.to (DevOps tag), Reddit r/devops
  • Tags:

4. Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses

  • Category: Deep Dive
  • What happened: CERT-UA has issued a warning about unauthorized remote access to Dahua IP cameras and DVRs, which allows attackers to compromise video streams, alter device configurations, and create unauthorized accounts.
  • Takeaway: Review and secure Dahua IP camera configurations to prevent unauthorized access.
  • Source: The Hacker News
  • Tags:

5. 2083449 - eMudhra: Private key compromise of Intermediate Certificates

  • Category: Deep Dive
  • What happened: eMudhra, a certificate authority, has suffered a private key compromise affecting their intermediate certificates, with the incident documented in Mozilla Bugzilla issue 2083449 and post-incident analysis currently underway. All certificates issued by the compromised eMudhra intermediates are now untrustworthy and could be used to perform man-in-the-middle attacks or impersonate domains. Operators should immediately identify any systems using certificates issued by eMudhra intermediates by checking the certificate chain in their TLS configurations, revoke and replace these certificates with ones from an unaffected certificate authority, and monitor browser/operating system trust store updates that will likely distrust the compromised intermediates. If your organization uses certificate pinning, update pins to exclude the compromised eMudhra intermediate certificate fingerprints to prevent acceptance of fraudulent certificates.
  • Takeaway: Informational: a private key compromise has been reported.
  • Sources: Bugzilla Mozilla via SRE Weekly, SRE Weekly
  • Tags:

6. AI coding agents hijacked using AGENTS.md file in Downloads folder

  • Category: Deep Dive
  • What happened: Researchers discovered that a malicious AGENTS markdown file placed in a user's Downloads folder can manipulate an AI coding agent to install a rogue npm package, posing a security risk.
  • Takeaway: Review and clean the Downloads folder for any unauthorized AGENTS.md files to prevent potential exploitation.
  • Source: Bleeping Computer
  • Tags:

7. Pods Running, Service returns 503: the selector bug that fools everyone

  • Category: Deep Dive
  • What happened: The article discusses a common issue in Kubernetes where a service returns a 503 error despite pods appearing healthy. It explains that the root cause often lies in the service's selector, which may not match the labels of the running pods, leading to an empty endpoint list. The author illustrates this with a practical example, showing how to diagnose the problem using kubectl commands and highlighting the importance of checking EndpointSlice objects. The piece emphasizes that even when pods are running, misconfigured selectors can prevent traffic from reaching them.
  • Takeaway: Understanding this selector issue is crucial for troubleshooting service availability in Kubernetes. Operators should ensure that service selectors correctly match pod labels to avoid 503 errors, even when pods appear healthy.
  • Source: dev.to (SRE tag)
  • Tags:

8. DepGate – an open-source "repository firewall" that blocks malicious packages at install time, across 8 ecosystems

  • Category: Deep Dive
  • What happened: DepGate is an open-source 'repository firewall' designed to block malicious packages during installation across multiple ecosystems like npm, PyPI, and Maven. It acts as a proxy that checks requests against a malware feed and user-defined policies before allowing package downloads. Features include known malware prevention, readable policies, a monitor mode for testing, dependency-confusion protection, and a decision ledger for tracking blocks. It is self-hosted and runs on a single Docker image.
  • Takeaway: Consider implementing DepGate as a proxy for your package managers to enhance security against malicious packages.
  • Source: Reddit r/devops
  • Tags:

9. GCP Introducing new scalable perimeter options with VPC Service Controls Google Cloud added folder membership

  • Category: Community
  • What happened: Google Cloud has enhanced VPC Service Controls by adding folder membership, allowing contained projects to inherit policies. The ingress and egress rules now support folders, organizations, and Private Service Connect endpoints.
  • Worth reading: Review and update your VPC Service Controls configurations to utilize folder membership for policy inheritance.
  • Source: CloudSecList
  • Tags:

10. Google Cloud BigQuery plugin (1.1.0)

  • Category: Community
  • What happened: The Google Cloud BigQuery plugin version 1.1.0 has a bug where the OAuth token exchange fails due to the client secret not being used correctly during the local exchange process. Although the team admin sets the CLIENT_ID and CLIENT_SECRET, the error indicates that an incorrect value is being sent instead of the team secret, leading to connection failures for users trying to authenticate through the plugin.
  • Worth reading: Informational: a bug in the Google Cloud BigQuery plugin affecting OAuth token exchange.
  • Source: Cursor Forum
  • Tags:

CVE & Security

11. CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

  • Category: Security / Patch
  • What happened: Two critical vulnerabilities in the PHP runtime itself, CVE-2026-109618 and CVE-2026-109619 (both rated CVSS 9.2), are under active exploitation by threat actors who have successfully compromised at least one government entity and extracted sensitive data including password hashes. These flaws enable unauthenticated remote code execution through memory corruption and use-after-free conditions in the PHP engine, meaning application-level patches are insufficient protection. Operators must upgrade the PHP runtime across all systems, not just update application code, and should inventory all PHP installations to ensure complete coverage. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, and attackers are using automated scanning combined with AI-assisted techniques to identify and exploit vulnerable systems.
  • Do this Monday: Immediately apply the latest patches for PHP2Shell to mitigate the risk of remote code execution.
  • Sources: The Hacker News, The Hacker News (2), dev.to (DevOps tag) (+1 more)
  • Tags:

12. Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

  • Category: Security / Patch
  • What happened: CVE-2026-111497, known as Brotli2Shell, is a critical buffer overflow vulnerability in Google's Brotli decoder library that enables remote code execution through an out-of-bounds write, with public proof-of-concept exploits already available. The vulnerability affects multiple widely deployed technologies including Node.js, .NET, Bun, Envoy Proxy, and Istio service mesh implementations. Operators should immediately upgrade to patched versions of affected software: for .NET applications, apply the latest security updates from Microsoft, and for Node.js, Envoy, Istio, and other implementations, upgrade to versions that include fixed Brotli library dependencies (specific version numbers will vary by project). In environments where immediate patching is not feasible, consider disabling Brotli compression acceptance at the application or proxy layer until updates can be applied.
  • Do this Monday: Upgrade any affected software using the Brotli decoder to mitigate the risk of remote code execution.
  • Sources: Security Boulevard, Tenable Blog, Microsoft MSRC Security Update Guide
  • Tags:

13. Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

  • Category: Security / Patch
  • What happened: A compromised device on a Tailscale network can exploit SSH flaws to gain root access to other servers if Tailscale SSH allows port forwarding and the attacker controls a permitted device. This vulnerability poses a significant risk to network security.
  • Do this Monday: Review Tailscale SSH configurations to ensure port forwarding is disabled and assess device access rules.
  • Source: The Hacker News
  • Tags:

14. ARMORY CASTLE Exploits BeyondTrust Google Threat Intelligence Group and Mandiant attribute zero-day exploitation

  • Category: Security / Patch
  • What happened: The article discusses the zero-day exploitation of BeyondTrust Remote Support CVE-2026-102764 attributed to the PRC-nexus group ARMORY CASTLE. The exploitation involved deploying a webshell and a SOCKS5 tunneler, escalating privileges, harvesting credentials, and deleting logs.
  • Do this Monday: Upgrade BeyondTrust Remote Support to the latest version to mitigate CVE-2026-102764.
  • Source: CloudSecList
  • Tags:

15. Apple Patches for October 2026, (Mon, Oct 26th)

  • Category: Security / Patch
  • What happened: Apple released patches for 304 vulnerabilities, including CVE-2026-86950, which is already exploited in CoreGraphics. Other notable issues include CVE-2026-86990, allowing unauthorized camera access, and CVE-2026-28864, which could expose Keychain items to local attackers. The update affects various versions of iOS, macOS, tvOS, and watchOS.
  • Do this Monday: Upgrade affected Apple devices to the latest versions to mitigate vulnerabilities, especially CVE-2026-86950 and CVE-2026-86990.
  • Source: SANS ISC
  • Tags:

16. PHP Security Alert: Mitigating the New Unpatched RCE Vulnerability

  • Category: Security / Patch
  • What happened: The PHP security team has issued a warning about a new remote code execution (RCE) vulnerability affecting certain non-default configurations of PHP. While no official patch is available, specific mitigation measures are recommended, including disabling certain PHP functions and adjusting configuration settings to reduce the attack surface. Developers are advised to audit their PHP configurations and apply these mitigations until a patch is released.
  • Do this Monday: Audit PHP configurations and apply recommended settings such as setting expose_php = Off and allow_url_fopen = Off to mitigate the RCE vulnerability.
  • Source: dev.to (DevOps tag)
  • Tags:

17. CVE-2026-114148 ASP.NET Core Elevation of Privilege Vulnerability

  • Category: Security / Patch
  • What happened: A vulnerability in ASP.NET Core allows an authorized attacker to elevate privileges locally due to incorrect default permissions.
  • Do this Monday: Upgrade ASP.NET Core to the latest version to mitigate the privilege escalation risk.
  • Source: Microsoft MSRC Security Update Guide
  • Tags:

Releases

18. Harbor v2.16.0-rc1: Valkey cache backend and multi-architecture support

  • Category: Release
  • What happened: Harbor v2.16.0-rc1 introduces several new features including a source column for accessory identification, a switch from Redis to Valkey as the cache backend, full multi-architecture support, and new API functionalities such as ListReferrers. Enhancements include fixes for pull times on artifacts, improved proxy cache configurations, and UI options for enabling proxy cache referrer API.
  • Takeaway: Informational: a new release with feature enhancements and fixes.
  • Source: Harbor releases
  • Tags:

Also this week

Deep dives & postmortems

19. Why Are Grocery Store Refrigerators Connected to the Internet?

  • Category: Deep Dive
  • What happened: An attack on French supermarket refrigeration systems highlights the risks associated with connected physical operations, which rely on long-lifecycle equipment and complex vendor access, leading to significant real-world consequences when security controls fail.
  • Takeaway: Informational: highlights risks of connected physical systems.
  • Source: Security Boulevard
  • Tags:

Status pages & maintenance

20. Claude: 2 service incidents (Elevated errors for Claude Fable 5.1, +1 more)

  • Category: Status Page
  • What happened: Claude API experienced elevated error rates affecting multiple models including Claude Fable 5.1 and Claude Sonnet 5.5 on October 25, 2026, between 08:08 UTC and 08:29 UTC. Anthropic deployed a fix during the incident window and the issue has been resolved. No operator action is required as the service has returned to normal operation and Anthropic continues to monitor for stability. Organizations experiencing lingering issues should verify their API clients are retrying failed requests and check that no requests are stuck in error states from the incident window.
  • Takeaway: Resolved incident with no ongoing impact.
  • Sources: Anthropic Status, Anthropic Status (2)
  • Tags:

21. The Datadog US1 Status Page Is Changing on October 29 2026.

  • Category: Status Page
  • What happened: Datadog's US1 status page will undergo a redesign on October 29, 2026, transitioning to a new format based on Datadog's Status Pages product. The new page will be accessible at the same URL, and existing email, Slack, RSS, SMS, and webhook notifications will continue without interruption. However, custom integrations relying on the old status page's URL or API structure may need updates to function correctly with the new format.
  • Heads up: Operators using custom integrations with Datadog's status page should prepare for potential disruptions and may need to update their integrations to align with the new page structure and API payloads.
  • Source: Datadog Status
  • Tags:

22. View package and auth outage on npmjs.com

  • Category: Status Page
  • What happened: An outage affecting package and authentication services on npmjs.com occurred on October 26, 2026, but has since been resolved. The issue was identified, a fix was implemented, and the situation is now being monitored.
  • Takeaway: Informational: npmjs.com services are operational after a recent outage.
  • Source: npm Status
  • Tags:

23. Cloudflare: 36 scheduled maintenance windows (Honolulu, Atlanta, Chennai, +21 more)

  • Category: Status Page
  • What happened: Cloudflare has scheduled maintenance across multiple datacenters from October 25-30, 2026, affecting regions including North America (IAH, ATL, SEA, DFW, DEN, AUS, IAD, EWR, BNA, TPA, OKC, ANC, HNL), Europe (AMS, ARN, LHR), Asia-Pacific (KIX, ICN, MAA, DEL), and Latin America (LIM, EZE, GIG, QRO), with specific maintenance windows varying by location (for example, IAH on October 28 from 07:00-13:00 UTC, AMS on October 29 from 02:00-06:00 UTC, and KIX on October 26 from 17:00-21:00 UTC). During these maintenance windows, traffic will be automatically rerouted which may increase latency for end-users in affected regions, and PNI/CNI customers should prepare for potential traffic failover and temporary unavailability of their dedicated network interfaces. Additionally, Cloudflare will perform storage system maintenance that will prevent configuration modifications via the Dashboard or public API for up to 3 minutes, affecting Custom Pages API, Workers Builds, and Log services. Operators should monitor latency metrics during the scheduled windows for their specific regions and ensure that automated failover mechanisms are functioning correctly for any PNI/CNI deployments.
  • Heads up: Operators should anticipate increased latency and possible traffic rerouting during the maintenance window, which could affect service availability for users in the Amsterdam region.
  • Sources: Cloudflare Status, Cloudflare Status (2), Cloudflare Status (3) (+33 more)
  • Tags:

Human Stories

The compromised LiteLLM package and eMudhra's certificate authority breach remind us that trust is a technical liability we rarely account for in our incident response plans. We've built systems that assume PyPI packages, Docker images, and certificate chains are safe by default, but this week showed how easily those assumptions collapse when a single upstream dependency or authority gets compromised. The Firebase outage is almost quaint by comparison - at least a bad server-side change is something we understand how to roll back. What keeps me up at night is the AGENTS.md attack, because it reveals how our newest tools have entirely new attack surfaces we haven't even begun to model. We're racing to adopt AI coding assistants and cloud abstractions while the security community is still figuring out what "a markdown file that reprograms your AI" even means as a threat category.

Also worth reading

Quebrei meu próprio sistema de propósito (e foi a melhor decisão da sprint) (dev.to (SRE tag))

The article discusses the importance of Chaos Engineering in distributed systems, highlighting how a slow dependency can cause failures that are harder to detect than outright crashes. It emphasizes the need for a mindset shift from preventing failures to understanding and managing them when they oc

When a glibc update accidentally breaks Chromium's audio (2021) (Lobsters)

A glibc update unintentionally caused audio issues in Chromium, leading to significant user complaints and discussions about the impact of library updates on application functionality. The incident highlights the importance of testing dependencies before deployment.

Grok Bot cloud computer rolled back on Oct 23, all bots lost weeks of work – human review needed (T-I23680) (Cursor Forum)

On October 23, 2026, a rollback of the Grok Bot cloud computer resulted in the loss of weeks of work for users. Files in various project folders were overwritten, and chat histories were reverted to earlier dates. The issue has been acknowledged by support but remains unresolved, rendering the platf
Kubernetes News Cloud News DevOps Security News CI/CD News SRE News