--- title: GitHub Releases quietly breaks Actions, LiteLLM's... description: GitHub had another bad day: a Releases outage cascaded into Actions failures while status pages reported misleadingly cheerful numbers. Separately, the fallout... canonical: https://daily.dev/posts/github-releases-quietly-breaks-actions-litellm-s-40-minute-pypi-window-burns-2-500-companies-pyrirjiv1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub Releases quietly breaks Actions, LiteLLM's 40-minute PyPI window burns 2,500 companies | daily.dev og:description: GitHub had another bad day: a Releases outage cascaded into Actions failures while status pages reported misleadingly cheerful numbers. Separately, the fallout... og:url: https://daily.dev/posts/github-releases-quietly-breaks-actions-litellm-s-40-minute-pypi-window-burns-2-500-companies-pyrirjiv1 og:image: https://api.daily.dev/og/posts/pyrirjiv1.png og:image:alt: GitHub Releases quietly breaks Actions, LiteLLM's 40-minute PyPI window burns 2,500 companies og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub Releases quietly breaks Actions, LiteLLM's 40-minute PyPI window burns 2,500 companies **[Backend Digest](https://daily.dev/sources/backend_digest)** · 4 min read · 1 upvotes · 0 comments ## Summary GitHub had another bad day: a Releases outage cascaded into Actions failures while status pages reported misleadingly cheerful numbers. Separately, the fallout from the LiteLLM supply-chain attack came into full focus, with 195TB of credentials exposed across 2,500 companies and 434,000 CI/CD pipelines touched by a 40-minute window of poisoned PyPI packages. Tailscale published a wild postmortem on a 16-year-old SQLite WAL bug, and a homelab admin walked through getting owned via an inherited Gitea RCE. On the infra side, Vercel detailed its Redis-to-DynamoDB build-state migration and Deepgram tripled default concurrency limits across its voice APIs. ## Content **TLDR:** GitHub had another bad day: a Releases outage cascaded into Actions failures while status pages reported misleadingly cheerful numbers. Separately, the fallout from the LiteLLM supply-chain attack came into full focus, with 195TB of credentials exposed across 2,500 companies and 434,000 CI/CD pipelines touched by a 40-minute window of poisoned PyPI packages. Tailscale published a wild postmortem on a 16-year-old SQLite WAL bug, and a homelab admin walked through getting owned via an inherited Gitea RCE. On the infra side, Vercel detailed its Redis-to-DynamoDB build-state migration and Deepgram tripled default concurrency limits across its voice APIs. --- ## LiteLLM supply-chain attack traced to a 40-minute PyPI window, hits 2,500 companies A compromised Trivy scanner infected LiteLLM's CI pipeline, letting two malicious PyPI packages live for about 40 minutes before detection. In that window, roughly 434,000 CI/CD pipelines were affected, and a single 195TB credential dump surfaced containing cloud keys, SSH keys, and Kubernetes secrets belonging to Microsoft, Amazon, Cisco, Nvidia, and hundreds of other companies. The FBI says the same group also hit Checkmarx's KICS and the Telnyx Python SDK, and is warning organizations to treat any touched credentials as permanently burned rather than assuming rotation isn't necessary once the packages are pulled. [Read more](https://daily.dev/posts/p7E2Oa9lG) ## GitHub Releases outage takes Actions down with it GitHub Releases went down, and since most Actions workflows pull artifacts from Releases as a routine step, the practical effect was widespread workflow failures even though Actions itself was technically fine. Status page messaging didn't help matters — GitHub reported 97% success rates for starting workflow runs while 85% of Actions webhooks reportedly weren't processing at all. It's a clean illustration of how much of the dev workflow quietly depends on a single point of failure, and how a technically-true status update can still feel like gaslighting when you're the edge case. [Read more](https://daily.dev/feed-by-ids?id=mMi4fgEAU&id=jlSbK76S3) ## Tailscale's 16-year-old SQLite WAL bug: months of forensics vs. 15 minutes of AI-assisted fuzzing Tailscale spent months chasing intermittent database corruption in its control plane before pinning it on a data race in SQLite's Write-Ahead Logging code — a bug that had been sitting there for at least 16 years, now fixed in SQLite 3.51.3. What makes this worth reading twice: a separate developer reproduced the same bug in 15 minutes using Antithesis paired with a Claude agent writing the test harness. Tailscale's months of custom tooling weren't wasted — they're what let the team isolate the bug live in production in the first place — but the gap between the two approaches is uncomfortable to sit with if you're responsible for critical infra built on assumptions nobody's stress-tested this hard. [Read more](https://daily.dev/posts/qBIKVYoyY) ## Homelab Forgejo instance rooted via inherited Gitea RCE and an open sign-up form A self-hosted Forgejo instance got compromised through CVE-2026-60004, an RCE in Gitea's diffpatch endpoint that Forgejo inherited unpatched. The attacker walked in through a sign-up form the owner thought was disabled, running an outdated EOL image, then planted a Git hook that pulled down a crypto miner. It's a useful reminder that self-hosted git forges carry the same patch-cadence obligations as anything internet-facing, and that inherited vulnerabilities from upstream forks don't announce themselves. [Read more](https://daily.dev/posts/DlHslsoqW) --- ## Also notable - **GitHub July 2026 availability report: Azure migration hits 52% of read traffic:** GitHub logged eight incidents in July plus a still-unresolved August 6 Actions outage, while confirming over 52% of monolith read traffic and 47% of Git traffic now run in Azure, targeting 70%/30% read/write this quarter ahead of a full datacenter exit by end of 2026. [Read more](https://daily.dev/posts/jlSbK76S3) - **Vercel migrates build-state store from Redis to DynamoDB under live traffic:** Vercel redesigned its build warm-pool schema around DynamoDB access patterns rather than porting Redis's data structures, using dual-writes and shadow reads, and hit two production incidents along the way, including an N+1 query bug that Redis's speed had been masking for years. [Read more](https://daily.dev/feed-by-ids?id=wsTvjzaBz&id=GmWbrSPDP&id=vJjwu23wh) - **Deepgram triples default concurrency limits across its voice APIs:** Pay-as-you-go concurrency caps jump to 45 (Voice Agent, TTS) and 150 (Streaming STT) connections, up from 15 and 50, effective immediately with no customer action required, aimed at cutting 429 errors for teams scaling voice AI traffic. [Read more](https://daily.dev/posts/BCfUF6IKh) - **Redpanda Stretch Clusters reach GA with RPO=0/RTO=0 across regions:** Redpanda Operator v26.2 lets a single logical cluster span multiple Kubernetes clusters across regions via synchronous Raft replication, delivering automatic failover with zero data loss and zero cutover time for Kafka workloads. [Read more](https://daily.dev/posts/MCtkzxA0g) - **Ecotone hits 157,266 confirmed messages/sec to Kafka from a single PHP process:** Enabling batching plus non-blocking confirmation via one builder call took Ecotone's outbox relay from 34.49 seconds to 0.2 seconds for draining 10,000 messages, with zero changes required to business handler code. [Read more](https://daily.dev/posts/K7nDZyB7U) ## Similar posts on daily.dev - [GitHub has another tough day](https://daily.dev/posts/github-has-another-tough-day-dvefjjxpq) · Surfing Complexity · 18 upvotes · 4 comments - [GitHub Actions is the weakest link](https://daily.dev/posts/github-actions-is-the-weakest-link-kx8cbboab) · Andrew Nesbitt · 1 upvotes · 0 comments - [GitHub availability report: July 2026](https://daily.dev/posts/github-availability-report-july-2026-jlsbk76s3) · GitHub Blog · 0 upvotes · 1 comments - [What’s gone wrong at GitHub?](https://daily.dev/posts/what-s-gone-wrong-at-github--5f7pmzqel) · LeadDev · 211 upvotes · 19 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#github-actions](https://daily.dev/tags/github-actions), [#sqlite](https://daily.dev/tags/sqlite) [View this post on daily.dev](https://daily.dev/posts/github-releases-quietly-breaks-actions-litellm-s-40-minute-pypi-window-burns-2-500-companies-pyrirjiv1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/github-releases-quietly-breaks-actions-litellm-s-40-minute-pypi-window-burns-2-500-companies-pyrirjiv1","headline":"GitHub Releases quietly breaks Actions, LiteLLM's 40-minute PyPI window burns 2,500 companies","text":"GitHub had another bad day: a Releases outage cascaded into Actions failures while status pages reported misleadingly cheerful numbers. Separately, the fallout from the LiteLLM supply-chain attack came into full focus, with 195TB of credentials exposed across 2,500 companies and 434,000 CI/CD pipelines touched by a 40-minute window of poisoned PyPI packages. Tailscale published a wild postmortem on a 16-year-old SQLite WAL bug, and a homelab admin walked through getting owned via an inherited Gitea RCE. On the infra side, Vercel detailed its Redis-to-DynamoDB build-state migration and Deepgram tripled default concurrency limits across its voice APIs.","url":"https://daily.dev/posts/github-releases-quietly-breaks-actions-litellm-s-40-minute-pypi-window-burns-2-500-companies-pyrirjiv1","datePublished":"2026-08-13T04:17:40.851Z","dateModified":"2026-09-13T21:21:21.435Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"GitHub Releases quietly breaks Actions, LiteLLM's 40-minute PyPI window burns 2,500 companies"}]} ```