CI CD: articles and guides

How to respond to a software supply chain incident: find every build and machine that ran the bad package, rotate secrets in the right order, check whether your own releases were tampered with, and tell downstream users when they were.

The October 2026 LiteLLM GitHub-identity compromise, as reported, step by step, and the GitHub control that would have ended the chain at each point.

OVHcloud disclosed on 19 Oct 2026 that its CLI repo was briefly compromised (v0.11.0-v0.15.0). What happened and the pipeline controls to check.

Want an application security free trial? Start with 6 free tools (Semgrep, ZAP, Trivy, Dependabot, Gitleaks, TruffleHog), then test vendors properly.

Backdoored LiteLLM 1.82.7 and 1.82.8 stayed on PyPI for 40 minutes in March 2026 — long enough to compromise over 2,400 organizations. A 153GB archive of the stolen data has now surfaced. Here is exactly what happened, the IOCs, and the remediation checklist.