October brought a surge of cybersecurity incidents ranging from massive cryptocurrency losses to software backdoors. Reports detailed breaches at major financial platforms, critical vulnerabilities in widely used development frameworks, and supply chain attacks affecting AI tools and trusted web infrastructure.
Massive Losses at Binance and Polymarket: Not Just Code, but Credentials
Binance is facing one of its gravest crises yet. In late October, investigations revealed suspicious wallet outflows amounting to $6.3 billion, with around $3 billion currently frozen by blockchain partners. The breach allegedly stemmed from compromised DevOps infrastructure—an engineer’s laptop reportedly accessed, allowing attackers to submit unauthorized withdrawal requests via a service container. Importantly, private signing keys haven’t been confirmed as compromised, and Binance has committed to covering losses. Final figures are still being verified.
Meanwhile, Polymarket suffered wallet theft after malicious JavaScript code scraped trader credentials from browser storage and targeted active trading sessions. Estimates suggest at least $2.7 million was stolen from 710 wallets, though Polymarket has yet to verify the full amount. In a related exposure, Coinbase said its analytics vendor Amplitude leaked customer contact data, though there was no threat to exchange balances.
Frameworks Under Fire & Developer Supply Chains Exposed
Web servers powered by PHP were jolted by two critical zero-day vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each rated 9.2 for severity. Issue: remote, unauthenticated attackers could execute code—especially in setups using Apache’s mod_php. PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 have been released to patch the flaws.
Node.js was also rocked in October, with ten separate security flaws identified—four rated high. Among them: memory corruption via Brotli decompression, TLS hostname mismatches, and DNS processing breaks. Patched builds include Node.js v26.12.1, 24.22.1, and 22.23.4. Developers are urged to ensure runtime updates encompass all environments, including containerized builds.
The open-source AI tool LiteLLM was hijacked in a supply-chain compromise. Version 1.107.0 introduced a malicious payload across its Python wheel packages, harvesting cloud credentials, SSH keys, browser data, and AI service tokens. Even isolated environments fell victim: misuse of startup hooks allowed execution without explicit imports, meaning build systems and routine maintenance were compromised too.
Secrets, Certificates & Global Breaches: Trust Shaken Worldwide
Several infrastructure platforms saw serious secret exposures. GitHub Actions workflows—through a campaign dubbed GhostAction—were found in nearly 800 repositories, risking software publishing tokens and service keys. A flaw in npm’s trusted publishing system put over 1,500 packages at risk of hijacking, though there’s no evidence all were weaponized. Cursor also confirmed malicious extension packages in its marketplace.
Cloud hosting firm Railway warned of possible exposure of encrypted environment variables which may hold sensitive credentials; external workloads were paused and users advised to rotate secrets. Meanwhile, coding tool OpenCode said a small slice (1.4%) of Console users were affected by access to legacy systems and third-party API keys.
On the cryptographic side, certificate authority eMudhra disclosed that eight intermediate intermediate CA private keys were weakly generated and could be recovered. Though infrastructure wasn’t breached, vendors moved immediately to block affected certificates. eMudhra also announced its exit from the SSL/TLS certificate market.
Government data also came under fire: the Pentagon revealed a breach that impacted over 3 million people through a file-sharing vulnerability, spanning October 2025 to July 2026. Denmark’s incident affected nearly 9 million registrations via misuse of a private company’s access to population records, including deceased and foreign individuals.
Corporate and retail sectors weren’t spared. Capcom reported exposure affecting nearly 11.8 million customer records. SoftBank’s older vendor issue—while dating back to mid-2025—surfaced again; some 137,000 users exposed. Grocery chains also saw system disruptions and even refrigeration systems impacted in France, underscoring that cyber threats touch all facets of operations.
These incidents display a pattern: exposed credentials and trusted update channels can magnify a single slip-up into a chain of risk. But volume alone doesn’t mean coordination. Many disclosures stem from different vectors—vulnerabilities, third-party data disclosures, or supply-chain poisonings. Separating confirmed exploits, estimated losses, and pure exposure remains essential.
October’s upheavals should sound alarms across all tech stacks. Attackers are clearly targeting not only software bugs, but the systems around software: credential stores, update pipelines, trust relationships. Moving forward, enforcing zero-trust policies, rigorous secrets management, and regular audits of runtime environments will turn from best practices to necessities. Watch closely how defenders adapt—patch adoption speed, supply chain oversight, and cross-platform trust assurances will define who we count among the resilient.
