5 dev-security stories from this week, and what to do about each: - railway env var breach - litellm 1.107.0 on pypi - node2shell in brotli - php2shell - github turning off pull_request_target on nov 2 one post each 🧵

the node2shell bug from this week came out of openai's red team. their own agents found it while attacking openai's training sandboxes on purpose. several of the other ways out were ordinary infra mistakes: DNS and firewall rules that let blocked requests through, a firewall-approved connection reused to reach a blocked endpoint, and internal services that fetched whatever URL the model gave them. the cpu cache side channel will get the headlines. if you sandbox agents, check your URL-fetching services first

the name says node, but node2shell is a bug in google's brotli decoder (CVE-2026-111497). bun and the python brotli packages ship the same code. fixed in: node 22.23.4 / 24.22.1 / 26.12.1 bun 1.4.4 python Brotli 1.2.1, brotlicffi 1.2.1.0 node lists no workaround. if your server decompresses brotli that someone else sent, patch first and argue about severity later

litellm 1.107.0 sat on PyPI for under two hours on Oct 21. Wiz estimates about 49k downloads. the wheels drop a .pth file into site-packages, so the stealer runs every time python starts. nobody had to import litellm. the GitHub tag was clean. only the built package was bad, so reading the source told you nothing. if a box pulled it, rotate every key it could see and rebuild the box

github actions has a lockfile now. it also pins the actions hidden inside composite actions, which a SHA pin in your yaml never reaches. i tampered with a lockfile on purpose. the first version i tried said it was fine. the update three days later caught it. the full test is in the reply.

github turns off pull_request_target by default in public repos on nov 2. 12 days left. 76 of the 200 most-starred repos use it, react, next.js and pytorch among them. mostly for housekeeping like labels and comments. evaluate mode already shows which of your runs would fail.

Harvard economists tracked 718 companies in Jellyfish data before and after they adopted coding agents. lines of code: up about 30% pull requests: up 23% time from PR to merge: up 49% Jira issues and epics closed: no real change the code gets written faster. then it sits in review.

DeepSeek now sells web search by API. 75 cents per 1000 searches, and only successful calls get billed. If you run DeepSeek inside Claude Code or Codex, those searches are free until Nov 1. Search is becoming a line item next to tokens. Count your agent's searches per task.

ONE MOVED GIT TAG PRINTED CI SECRETS INTO BUILD LOGS. that was tj-actions/changed-files in march 2025. workflows pinned to a commit SHA were fine. so i built pin check. paste a workflow and get it back pinned to full SHAs, with the old tags kept as comments. what should it check next?

5 AI/dev stories from this week worth acting on: - opencode console breach - gemini 4 argon opens to all paid API users - meta open-weights muse spark - github ai scan for PRs goes GA - deepseek v4.1 flash 1017 under MIT one post each 🧵