Hacktober Wave: Binance, PHP, Node.js, and LiteLLM Hit by Diverse Cyberattacks
October saw a significant surge in cyberattacks, impacting major platforms like Binance and essential software like PHP and Node.js, alongside a supply chain compromise in LiteLLM.
October proved to be a "Hacktober" for the cybersecurity world, marked by a broad spectrum of attacks affecting cryptocurrency exchanges, web servers, AI tools, and software packages. Notable incidents included Binance investigating a potential $6.3 billion incident, PHP issuing emergency fixes for critical vulnerabilities, and a malicious LiteLLM release compromising developer credentials. These events underscore the pervasive risks associated with exposed credentials and the exploitation of trusted software channels.
Binance, the prominent cryptocurrency exchange, became a focal point after suspending deposits and withdrawals due to a security investigation. Initial reports suggested the incident, potentially impacting up to $6.3 billion in unauthorized transactions, may have originated from a compromised DevOps engineer's laptop. Attackers reportedly gained access to a service container, enabling them to initiate unauthorized withdrawals. While Binance stated it found no evidence of leaked private keys and pledged to cover losses, the scale of the event highlights the vulnerabilities in transaction processing systems, even when private keys remain secure.
Beyond the Binance incident, other financial platforms faced threats. Polymarket reported a wallet theft where malicious JavaScript targeted trading credentials stored in browsers, with over $2.7 million linked to affected wallets. Separately, Coinbase disclosed a security incident affecting its analytics provider, Amplitude, which exposed some customer contact information. However, Coinbase emphasized that its own systems and customer funds remained unaffected, distinguishing this from direct cryptocurrency theft.
Web server security was significantly challenged by two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell. These vulnerabilities, with a CVSS score of 9.2, could allow unauthenticated attackers to execute code on affected servers, particularly when using Apache's mod_php module. The PHP project released emergency patches, including versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, making runtime updates critical for organizations.
Adding to the workload for development teams, Node.js also saw a series of security updates. Ten vulnerabilities were disclosed, including four rated as high severity, involving issues such as Brotli decompression memory corruption and TLS hostname validation. Patched releases included Node.js 26.12.1, 24.22.1, and 22.23.4. The combined disclosures for PHP and Node.js emphasized the need for comprehensive runtime inventories and timely updates across development and production environments.
The LiteLLM supply-chain compromise served as a stark reminder of the risks inherent in software dependencies. Version 1.107.0, distributed via PyPI, was found to contain a credential stealer and remote access malware, demonstrating how a trusted update mechanism can be subverted to deliver malicious payloads. This incident, alongside the PHP and Node.js vulnerabilities, contributed to a challenging period for web security, impacting a vast number of websites and user trust.
The "Hacktober" wave, while capturing the sheer volume of incidents, should not be mistaken for a single coordinated campaign. The reported events encompass diverse attack vectors, discovery timelines, and levels of confirmed impact, ranging from actual data theft to potential exposures and malicious package distributions. Understanding these distinctions is crucial for effective risk assessment and response.