Hacktober - Cyberattack Wave Hits PHP, Node.js, Binance, LiteLLM, Pentagon, and a Few More - CyberSecurityNews

October brought a heavy run of cybersecurity disclosures involving cryptocurrency exchanges, web servers, AI tools, software packages, government records, and grocery chains. Binance investigated billions of dollars in unauthorized transactions, PHP issued emergency fixes, and a malicious LiteLLM release put developer credentials at risk.

Other incidents involved Railway, OpenCode, Polymarket, Coinbase, Cursor, eMudhra, and Capcom. Together, these reports show how exposed credentials and trusted software channels can turn a limited intrusion into a much larger security problem.

Binance Wallet Drain

Binance became the largest financial story in the roundup after suspending deposits and withdrawals during a security investigation. The estimated incident impact reached $6.3 billion, with around $3 billion frozen through blockchain partners. Early findings reportedly pointed to a compromised DevOps engineer's laptop, which attackers may have used to access a service container and submit unauthorized withdrawals.

We had not found evidence that wallet private keys were leaked and stated that it would cover losses.

PHP and Node.js Vulnerabilities

PHP2Shell emerged as a major concern for web administrators due to two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both with severity scores of 9.2. These memory-handling flaws could allow unauthenticated attackers to execute code on vulnerable servers. Fixed releases included PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Simultaneously, Node.js security updates arrived with ten vulnerabilities, including four rated high severity. Issues involved Brotli decompression memory corruption, TLS hostname validation, and DNS handling. Patched versions included Node.js 26.12.1, 24.22.1, and 22.23.4.

Supply Chain Compromises

The LiteLLM supply-chain compromise showed how a software update could become an entry point. Version 1.107.0 reportedly contained a credential stealer and remote access malware across all wheel files. The malicious code searched for cloud credentials, SSH keys, browser information, and AI service tokens.

GitHub Actions faced the GhostAction campaign, which placed malicious workflows in 790 repositories, putting cloud credentials and software publishing tokens at risk. npm reported a trusted-publishing weakness exposing over 1,500 packages to possible takeover. Cursor confirmed malicious Claude Code extension packages in its marketplace.

Platform Exposures

Polymarket faced a separate incident where malicious JavaScript searched browser storage for trading credentials, with at least $2.7 million in withdrawals linked to 710 wallets. Coinbase's disclosure involved its analytics provider Amplitude exposing some customer contact information, though Coinbase systems and funds remained unaffected.

Railway disclosed possible unauthorized access to customer environment variables, including decrypted values containing database passwords and cloud tokens. OpenCode reported that its breach affected 1.4% of Console users, including some workspaces with linked external providers.