Cyberattack Wave Hits PHP, Node.js, Binance, LiteLLM, Pentagon, and a Few More

October brought a heavy run of cybersecurity disclosures involving cryptocurrency exchanges, web servers, AI tools, software packages, government records, and grocery chains.

Binance investigated billions of dollars in unauthorized transactions, PHP issued emergency fixes, and a malicious LiteLLM release put developer credentials at risk.

Other incidents involved Railway, OpenCode, Polymarket, Coinbase, Cursor, eMudhra, and Capcom. Together, these reports show how exposed credentials and trusted software channels can turn a limited intrusion into a much larger security problem.

The name “Hacktober” captures the volume of news, but it should not suggest that every event belonged to one coordinated campaign. The reports cover different attack methods, discovery dates, and levels of confirmation.

Some describe confirmed data theft; others involve possible exposure, malicious packages, or vulnerabilities that could enable an attack. Keeping those categories separate is essential to understanding what happened and who actually faced risk.

Binance Investigates Multibillion-Dollar Wallet Drain

Binance became the largest financial story in the roundup after suspending deposits and withdrawals during a security investigation. Cybersecurity News’ updated Binance breach report placed the estimated incident impact at $6.3 billion and reported that around $3 billion had been frozen through blockchain partners. These figures require careful wording.

The total associated with suspicious transactions is not necessarily the final amount permanently lost, particularly while investigators are tracing funds and arranging freezes.

Early findings reportedly pointed to a compromised DevOps engineer’s laptop. Attackers may have used that access to reach a service container and submit unauthorized withdrawals.

Binance said it had not found evidence that wallet private keys were leaked and stated that it would cover losses. That separates the reported attack from a simple private-key theft scenario. Systems that prepare, authorize, or process transactions can become targets even when the signing keys themselves remain protected.

The scale could place the event among the largest cryptocurrency thefts reported, but describing it as the largest completed heist requires a settled loss figure. Investigators still needed to distinguish unauthorized outflows, frozen assets, recovered funds, and the amount ultimately left unrecovered.

Polymarket Wallet Theft and Coinbase Vendor Exposure

Polymarket faced a separate incident involving its international platform. According to Cybersecurity News’ Polymarket coverage, malicious JavaScript searched browser storage for trading credentials and attempted to reach an active trading client. Outside analysis connected at least $2.7 million in withdrawals to 710 wallets, although Polymarket had not confirmed that total. The reported behavior placed browser-held credentials and active sessions at the center of the investigation.

Coinbase’s disclosure involved a different type of exposure. Its analytics provider, Amplitude, experienced a security incident that exposed some customer contact information. Coinbase said its own systems and customer funds were not affected. The Coinbase vendor incident report therefore should not be described as another exchange wallet drain. Its main concern was customer information held by a third party, rather than confirmed access to cryptocurrency balances.

PHP2Shell Creates an Urgent Web Server Patching Problem

PHP2Shell became a major concern for web administrators because it involved two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both received severity scores of 9.2. Reporting described memory-handling flaws that could allow an unauthenticated attacker to execute code on affected servers under vulnerable configurations. Researchers demonstrated an attack path involving Apache’s mod_php module before normal application code ran.

The PHP emergency patch report listed fixed releases including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. This made the underlying runtime, rather than only the website’s application code, the focus of remediation. A site could use an updated content management system and still remain exposed if its PHP installation was vulnerable. Running workers also needed to load the corrected build before the update could provide protection.

The attack timeline added urgency, but it also required precision. AWS reported exploitation attempts before public disclosure. Later reporting distinguished scanning and failed attempts from evidence of successful compromise in another observed environment. Cybersecurity News’ PHP2Shell exploit analysis explains why public exploit availability, attempted exploitation, and confirmed server compromise should not be treated as the same finding.

Node.js Updates Add to the Developer Workload

Node.js security updates arrived alongside the PHP emergency, increasing the workload for teams responsible for public-facing applications and development infrastructure. The October 21 security roundup described ten Node.js vulnerabilities, including four rated high severity. Reported issues involved Brotli decompression memory corruption, TLS hostname validation, and DNS handling.

Patched releases listed in the coverage included Node.js 26.12.1, 24.22.1, and 22.23.4. For organizations using containers, the relevant version was the runtime inside the deployed image. Updating a development laptop or a server’s default Node.js installation would not automatically replace an older runtime bundled into a separate application image. The combined PHP and Node.js disclosures made runtime inventories an important part of the response.

LiteLLM Turns a Trusted Update Into a Credential Threat

The LiteLLM supply-chain compromise showed how a software update could become the initial entry point. Version 1.107.0 reportedly reached PyPI with a credential stealer and remote access malware across all seven wheel files. Affected container tags extended the exposure beyond users who installed the Python package directly.

The malicious code searched for cloud credentials, SSH keys, browser information, and AI service tokens. Python startup hooks made the attack particularly concerning because execution did not depend on an application explicitly importing LiteLLM. A routine Python command inside a contaminated environment could activate the payload. That widened the risk to build jobs and maintenance tasks that might not appear directly connected to the affected application.

Reporting linked the compromised release to stolen GitHub credentials and a workflow redirected toward a lookalike repository. Stolen AWS credentials were reportedly used within roughly four and a half hours. A downgrade alone would not reverse that exposure. Recovery required treating credentials available to the affected environment as potentially stolen, alongside replacing contaminated software and rebuilding from a trusted source.

GitHub Actions, npm, and Cursor Highlight Supply-Chain Weaknesses

The statement “GitHub Actions got hacked” needs a narrower explanation. Cybersecurity News reported that the GhostAction campaign placed malicious workflows in 790 repositories. Those workflows put cloud credentials, software publishing tokens, and AI service keys at risk. The GhostAction investigation described abuse of repository automation, not proof that GitHub’s central platform had been breached.

npm reporting also covered different categories of risk. An October disclosure described a trusted-publishing weakness that exposed more than 1,500 packages to possible takeover. That finding should not be converted into a claim that every affected package had already delivered malware. The npm trusted-publishing report concerned an attack opportunity, which is distinct from a confirmed malicious release.

Cursor separately confirmed that malicious Claude Code extension packages had appeared in its extension marketplace. The Cursor marketplace report demonstrated another trusted delivery route that attackers could abuse. The relevant issue was the distribution of malicious extension packages, rather than evidence that every Cursor installation or the entire editor codebase was compromised.

Railway and OpenCode Face Stored-Secret Exposure

Railway disclosed possible unauthorized access to customer environment variables, including some decrypted values. Such variables may contain database passwords, cloud tokens, registry credentials, and AI provider keys. The company paused deployments during its investigation and advised customers to rotate secrets. Its security incident disclosure described possible exposure, not a confirmed theft of every customer’s configuration.

OpenCode said its breach affected 1.4% of Console users, including some workspaces with linked external providers. Unauthorized access to a legacy system may have exposed third-party API keys. The OpenCode breach report matters because the percentage applies to the identified Console population, not automatically to every person using the open-source coding tool.

These incidents illustrate why the scope of a secret store matters. A single affected platform may hold credentials that unlock services operated by several other companies. The initial breach and any later misuse of those keys remain separate events, even when they share the same starting point.

Fireworks AI, TiDB Cloud, and Warp Require Careful Scope

Fireworks AI, TiDB Cloud, and Warp also appeared in October’s developer-platform incident reporting. However, the available research for this article did not establish matching Cybersecurity News reports for all three. Their inclusion should not become a blanket claim that every customer model, hosted database, or development session was accessed.

The same reporting rule applies across this roundup. Exposure of internal credentials, management records, or vendor-held logs does not automatically establish theft of the main service’s complete customer dataset. Where the requested publication does not provide a verified account, detailed claims should remain outside the article rather than being presented as confirmed facts.

eMudhra’s Certificate Problem Threatens Browser Trust

The eMudhra certificate authority disclosure involved eight intermediate certificate authority private keys that were recoverable because of weak key generation. Reporting described extremely small private values, making recovery possible almost immediately. Browser and operating system vendors moved to block the affected certificates.

This was not established as a conventional intrusion into eMudhra’s network. The company said its infrastructure had not been compromised and that the affected intermediate authorities had issued no end-entity certificates. It later announced its exit from the global SSL/TLS certificate business. The follow-up coverage underlines the distinction between a recoverable cryptographic key and a confirmed network breach. Both can create serious trust problems, but they arise differently.

Pentagon and Denmark Disclosures Expose Sensitive Records

The Pentagon personnel data breach reportedly affected more than three million people, including around 2.76 million living individuals and 294,000 deceased people. Unauthorized access reportedly occurred between October 2025 and July 2026 through a file-sharing vulnerability. The disclosure therefore belongs in the wider wave of security news, but the intrusion itself did not begin in October 2026.

Denmark’s separate incident involved approximately 8.8 million registered people. According to Cybersecurity News’ Denmark breach coverage, the access involved misuse of a private company’s permitted connection to population records. The total included deceased people and people living abroad, explaining why it exceeded the country’s current population. These details are necessary to avoid presenting the figure as 8.8 million current residents.

Capcom disclosed exposure involving 11,774,247 customer records in its CAPCOM ID incident report. SoftBank also appeared in breach discussions, but its documented third-party data exposure dated to June 2025 and affected 137,000 users. That older event should not be repackaged as a newly confirmed October breach of SoftBank’s entire network.

Retail reporting showed that cyber incidents can disrupt operations as well as expose records. Ahold Delhaize took some systems offline after identifying a security issue, according to its October incident coverage.

Reports of remotely disrupted French supermarket refrigeration added another operational concern, although this research did not identify matching Cybersecurity News coverage suitable for linking here.

Across the verified cases, scope remains the most important reporting detail. A malicious package is not the same as a compromised registry, a vendor breach is not automatically a breach of every customer system, and an estimated cryptocurrency outflow is not a final loss figure. Those distinctions make the October wave more understandable without making its impact any less serious.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?