Episode 704: When You Can’t Trust Your Software Updates

Calvin Hendryx-Parker, co-founder and CTO of Six Feet Up, takes the host chair for a week some are calling Black October: remote shell exploits across the PHP world, a certificate authority with crackable keys, a Brotli RCE in Python, and a second CI pipeline compromise at LiteLLM after a leaked key wasn't fully revoked. Keith Townsend asks whether these are developer problems or operator problems, and how you practice zero trust when the security updates themselves can't be trusted. Calvin makes the case for package cooldowns in uv and pip, Keith counters with the patches you can't afford to wait on, and both land on least privilege for the keys that run your build pipelines. Keith tells the story of a coding assistant that killed every app on his Mac when asked to stop one experiment, which leads to smaller agents with scoped, time-bound permissions, code smells for operations, and practical advice for teams without a dedicated security staff.