Skip to main content
NewLiteLLM 1.107.0 Was Built From a Lookalike Fork: What PyPI Provenance Can and Cannot Tell You

Learn DevOps by doing,
not just reading.

761+ articles, guides, and hands-on learning tools for engineers who prefer a terminal over a slide deck.

Join 1,500+ DevOps engineers learning every week

kubectl --watch
$
devops-daily --stats

// featured

Interactive Simulators

Browse all simulators

// categories

Popular Categories

Explore our content by topic

// exercises

Hands-On Exercises

Practice real-world DevOps scenarios with step-by-step guidance

View all exercises

// quizzes

Test Your Knowledge

Short interactive quizzes across Docker, Kubernetes, Terraform, networking, and more

// posts

Latest Posts

Stay up to date with the latest DevOps content

Python

LiteLLM 1.107.0 Was Built From a Lookalike Fork: What PyPI Provenance Can and Cannot Tell You

The poisoned LiteLLM release came out of the real release pipeline, fed from a fork one hyphen away. We measured what a PyPI attestation would have shown, what the Docker image provenance showed, and how many of the 1,000 most downloaded PyPI projects publish attestations at all: 39%.

|18 min read
CI/CD

Why Your GitHub Actions Bill Keeps Growing, and What Each Fix Saves

Per-job rounding, macOS minutes at ten times the Linux price, re-runs and storage add up quietly. We measured where one repository's minutes went in 30 days, then ran a mobile pull request pipeline 34 times on GitHub-hosted runners and on Bitrise Build Hub to see what faster machines change in time and money.

|20 min read
Linux

Node.js October 2026 Security Release: Finding Every Node You Actually Run

Node.js 22.23.4, 24.22.1 and 26.12.1 fix a Brotli decoder bug that the project says permits remote code execution, plus TLS and DNS bugs. The version bump is one line. pm2 entries, the pm2 daemon, systemd units, cron jobs and containers each keep their own Node, so here is how to find every one and prove it moved.

|17 min read
Linux

PHP2Shell: How to Check That Every PHP You Run Is Actually Patched

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical remote code execution bugs. Installing the update is the easy part. A patched Ubuntu PHP still says 8.3.6, running workers keep the old code, and 4.4 hours after the release 8 of 39 popular images still shipped a vulnerable PHP. Here is how to find the PHP you run and prove it is fixed.

|19 min read
DevOps

A Service Catalog Nobody Updates Can Be Worse Than None: We Checked 217 Entries Against GitHub

We checked 217 public Backstage catalog entries from 30 organizations against GitHub. One in ten had a record GitHub contradicts, three owners in four could not be checked from outside, and where the catalog and CODEOWNERS both named an owner, they agreed only half the time. Here is the checker, the method, and how to keep a catalog honest.

|20 min read
FinOps

What Keeps a Neon Compute Awake, and What It Costs

We watched Neon computes through the API to see which clients stop scale to zero. Idle connections do not. An open transaction, a monitoring agent and a health check every 5 minutes do, and that health check keeps the smallest compute running 180 CU-hours a month.

|18 min read

// guides

Latest Guides

Step-by-step tutorials to boost your DevOps skills

// tools

DevOps Tools and Calculators

Free, browser-only utilities. CIDR, JWT, base64, UUID, cron, K8s sizing, YAML. No sign-up, no server.

// about

DevOps Daily is a free, independent education platform for engineers who want to learn by running things, not by reading pitch decks. Kubernetes, Docker, Terraform, CI/CD, observability, and security, through hands-on simulators, quizzes, exercises, and a weekly newsletter.

Free
$0
forever
Tools
61
interactive
Subscribers
1,500+
engineers
Cadence
Weekly
no spam

// sponsors

Supported by

DevOps Daily stays free because these companies sponsor it.

  • Bitrise
  • Atomsized
  • DigitalOcean
  • DevDojo
  • SMTPfast
  • QuizAPI
Become a sponsor
devops-daily --subscribe
$ echo "Weekly DevOps digest. No spam. Unsubscribe anytime."
Weekly DevOps digest. No spam. Unsubscribe anytime.
$ subscribe --email
$

1,500+ engineers subscribed