Digest #237: LiteLLM's compromised release, PHP's two critical RCEs, GCP billing hijacks and cheaper AI reviews

Also inside: Brotli's impact beyond Node.js, patching EC2 without replacing instances, and testing multi-tenant GPU clusters without GPUs.

LiteLLM’s latest supply-chain attack started with a leaked key that was removed from Git history but never revoked. PHP’s two critical RCEs and Brotli’s decoder flaw make this a week to check runtime…