October Security Roundup: Breaches, Stolen Keys and Critical PHP Flaws

October 2026 was Cybersecurity Awareness Month, and if you weren't aware of that by the start of the month, by the end of the month it was pretty hard to ignore.

Even the BBC’s cyber correspondent, Joe Tidy, found himself learning about PHP, admitting he hadn’t known it existed until the day before. The language behind much of the web had suddenly become headline news as website operators scrambled to apply emergency security fixes.

October ended with spooky costumes and trick-or-treating for one night, but for people working in cybersecurity, Halloween seemed to last all month. With ghosts in the machine and attackers playing tricks on everything from hosting platforms to trusted software downloads, there were few treats and little rest.

This security news roundup covers October's breaches, malicious software releases and critical vulnerabilities through 31 October, with the checks developers and site owners need to make.

• PHP's reach made its flaws especially urgent. PHP runs on roughly 70% of websites whose server-side language W3Techs can identify. That usage figure does not measure how many sites were exploited.
• Trusted downloads became a route into developer machines. LiteLLM, OVHcloud CLI and a Claude Code extension in Cursor's marketplace distributed malicious releases through their usual channels.
• Stolen keys put connected services at risk. Railway warned customers to rotate secrets, while attackers used TeamUpdraft connections to create administrators on WordPress sites.
• Recovery continued after providers blocked the initial attacks. TeamUpdraft found delayed administrator creation, and LiteLLM disclosed a separate Enterprise flaw later in the month.

5 October: SubQuery Package Backdoored

StepSecurity identified a backdoor in @subql/common 5.8.3, published on 5 October. Because SubQuery's blockchain-indexing tools share dependencies, projects could receive the compromised package through another SubQuery package, depending on their dependency ranges and lockfiles.

The backdoor could run during installation or module import, so disabling install scripts alone does not make an affected application safe. A maintainer response on 10 October acknowledged deleting the publishing token and beginning an investigation.

8 October: Tensorlake Package Carries Destructive Malware

Tensorlake, an infrastructure provider for AI applications and agents, identified malicious npm version 0.5.144, published on 8 October and available from 01:12 to 02:54 UTC. The notice scopes the incident to npm; its Python package, Rust crate and standalone CLI were unaffected.

Do not start by revoking a stolen GitHub token while the malware remains active. Tensorlake warns that the installed gh-token-monitor persistence can delete the user's home directory when it detects token revocation. Isolate affected machines and follow the advisory's removal procedure before rotating credentials from a clean system.

8–12 October: GhostAction Targets GitHub Repositories

GitGuardian's October investigation described renewed GhostAction activity: attackers used compromised accounts to inject GitHub Actions workflows intended to extract repository secrets. Its 13 October update described more than 30,000 repositories targeted during an 8–9 October expansion.

Early October workflows executed before GitHub began blocking them on 9 October; the 10 and 12 October batches could not extract secrets. The targeting figure therefore does not count confirmed compromises.

14 October: Zeabur Breach Precedes Shutdown

Zeabur, a cloud application hosting platform, confirmed an attacker reached internal systems and some customer services on 14 October, with broader impact than its August incident. Its announcement said known attack paths were contained while the investigation continued.

In its 17 October announcement, Zeabur said it would wind down, leaving customers to recover from the breach while arranging a move to another host. Shared-cluster services pause on 1 December, with all dedicated servers and shared clusters scheduled to stop by 31 December. Customers need to migrate before their individual service expiry dates.

15–16 October: Rank Math Distributes Malware

Rank Math, a WordPress search engine optimisation plugin, confirmed malware in affected PRO 3.0.123 downloads obtained between 15 October, 20:02 UTC and 16 October, 07:12 UTC. Activation of an affected copy means the site should be treated as compromised.

The free WordPress.org plugin was unaffected by the malicious package. Rank Math released clean PRO version 3.0.124, but its recovery guide warns that hidden mechanisms can recreate backdoors, so a routine plugin update is insufficient for a compromised site. Follow the ordered recovery guide, preferably restoring files and database from a clean pre-incident backup.

16 October: ConnectWise Discloses Credential Compromise

ConnectWise's Cloud Backup advisory, first published on 16 October, described compromised application credentials affecting the Microsoft 365 backup service formerly known as SkyKick. Customers need to investigate activity in connected Microsoft 365 tenants.

By its 30 October, 21:00 UTC update, backups and restores were available for re-authorised tenants, alongside portals and monitoring. Reporting, exports and billing were still being restored, with no indication reported that backup archives were compromised.

17 October: OpenCode Reports Exposed Provider Keys

OpenCode said a breach affected 1.4% of users of Console, its hosted service for accessing AI models, with linked external providers, according to its 17 October announcement, reproduced by The Hacker News.

The exposed keys were saved in Console, rather than locally by the coding application. BleepingComputer reported user accounts of unauthorised API charges, although a total loss figure has not been verified.

17–18 October: TeamUpdraft Finds an Intrusion

TeamUpdraft, the company behind WordPress tools including UpdraftPlus and UpdraftCentral, disclosed unauthorised access identified over 17–18 October and said its customer database was likely accessed. It held contact and order information, password hashes, two-factor settings and product connection keys.

The company said attackers used UpdraftCentral connections to create administrators and install malicious plugins on customer sites. It said the UpdraftPlus plugin downloads themselves were unaffected; its containment update revoked connection keys. Premium users were also told to inspect sites even if they had never used UpdraftCentral.

On 29 October, TeamUpdraft warned that malicious plugins left behind had created new administrator accounts after sites were disconnected. Check every site ever connected to UpdraftCentral Cloud, including free and Premium installations that show no symptoms, and follow its account-reset and site-cleanup instructions.

19 October: OVHcloud CLI Downloads Replaced

OVHcloud, a cloud infrastructure and hosting provider, said a compromised developer account replaced downloads of its command-line tool on 19 October. Affected binaries covered v0.11.0 through v0.15.0, downloaded between 12:47 and 14:21 UTC.

OVHcloud said its source code, build chain and downloads obtained before that window were unaffected. The malicious binaries targeted developer and cloud credentials, so check the file's hash against the advisory and establish when you downloaded it.

20 October: Google Announces eMudhra Trust Changes

Google said private keys for eight eMudhra intermediate certificates were reported compromised on 17 October. Weak key generation at the digital certificate provider created the risk of forged HTTPS certificates, undermining the trust browsers use to authenticate websites.

Google blocked the affected keys in Chrome and issued Android trust updates. Its 20 October notice announced removal of the emSign ECC Root CA - G3 hierarchy from Chrome trust, with rollout scheduled for 27 October, Pacific time. Operators using that chain need replacement certificates; the notice does not confirm rollout completion on every device.

21 October: PHP Releases Emergency Fixes

The PHP team released emergency fixes on 21 October for CVE-2026-109618 and CVE-2026-109619, which can permit remote code execution without logging in. PHP says all installations serving web requests need attention, with demonstrated pre-application exploitation making Apache mod_php particularly high risk.

Wiz researchers demonstrated unauthenticated server takeover using AI-assisted research. PHP released security fixes for supported branches in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Updating WordPress alone cannot patch its underlying PHP runtime; see our PHP and WordPress report.

PHP added two follow-ups: its 23 October guidance recommends disabling session.upload_progress.enabled for an unusual session-handler configuration until the next bugfix release. On 26 October, it rebuilt Windows packages with the -1 suffix to fix a separate Brotli decompression flaw; the PHP runtime version itself remains unchanged.

21 October: Railway Warns of Exposed Secrets

Railway, a cloud application hosting platform, said in its 21 October disclosure that an intruder may have accessed encrypted environment variables and decrypted some contents. It advised every customer to rotate stored secrets, despite an initial assessment suggesting a subset of users might be affected.

Railway marked the platform outage resolved at 22:06 UTC on 23 October. Its API, dashboard, builds and deployments were operating normally again, although customers still needed to rotate potentially exposed secrets. Its preliminary report estimated potential exposure in at most 1.85% of workspaces and continued recommending rotation for all customers who joined before 21 October.

21 October: LiteLLM Ships Malicious Releases

LiteLLM, an open-source gateway that routes requests to AI models, said its release pipeline was compromised on 21 October. Malicious 1.107.0 Python wheels were available from 11:39 to 13:23 UTC.

Compromised Docker Hub tags included v1.107.0, latest, main-latest and main-stable between 11:46 and 14:20 UTC.

The corresponding GHCR tags were compromised from 11:46 until removal by 13:51 UTC. Its 23 October investigation traced the attack to an administrative key exposed in May but never revoked. The attacker used it to obtain a GitHub organisation owner token and redirect the release pipeline.

The payload steals credentials and loads remote-code execution tools, and LiteLLM's recovery guidance warns that starting Python in an affected environment, even through pip, can execute it again. The company said its private enterprise release was unaffected by this malicious release.

A separate 27 October advisory affects Enterprise-licensed proxies: unauthenticated requests can expose local files and master keys. The affected release branches received fixes in 1.103.10, 1.104.8, 1.105.6 and 1.106.5.

The earlier 1.106.2 rollback recommendation does not cover this flaw; deployments without an Enterprise licence are unaffected by it.

LiteLLM's 30 October response reported dedicated owner accounts and device-bound release approval in place. Independent artifact verification and automatic withdrawal of mismatches remained planned for December.

21 October: Node.js Patches Runtime Vulnerabilities

The 21 October Node.js security release addressed vulnerabilities including a Brotli memory-write flaw with possible remote code execution and certificate-validation issues. It did not report confirmed compromises.

Node.js issued security fixes in three supported release lines: 22.23.4, 24.22.1 and 26.12.1. Updating a JavaScript library does not automatically update the Node.js executable inside an existing server or container.

21 October: GitLab Fixes Remote Code Execution in Regex Compilation

GitLab's 21 October critical release fixed CVE-2026-110264, which can permit unauthenticated server code execution through a crafted regular expression under certain conditions.

GitLab.com was already patched; self-managed installations need the fixed release for their branch listed in the advisory.

Ruby's 23 October releases fixed the underlying regex-engine bugs in 4.0.9, 3.4.12 and 3.3.13. Other Ruby applications are exposed when they compile attacker-controlled patterns; applications using only developer-written expressions are unaffected by these bugs.

21 October: Tailscale Updates Certificate Protections

Tailscale, a service that connects devices over a private network, responded in its 21 October bulletin to eMudhra's certificate incident with updated trust protections. The fix arrived in Tailscale 1.104.2 through an updated Go runtime, and the company said it also updated its internal services. Normal node-to-node WireGuard traffic was unaffected; the bulletin concerns certificate trust rather than an intrusion into Tailscale's infrastructure.

Separate 26 October bulletins fixed SSH forwarding and Serve flaws in 1.104.4. Authorised SSH peers with forwarding access could reach root-only sockets. If you use SSH forwarding or Serve, check the affected configurations in those bulletins and install 1.104.4 or later.

22 October: EDK II Discloses Pre-Boot Flaw

TianoCore's 22 October advisory described a critical flaw in EDK II firmware used for PXE network boot. Crafted network error packets can corrupt memory and execute code before the operating system loads, while an affected machine is booting over the network.

The advisory still lists no patched version, although its linked source fix was merged on 15 October. Ask your hardware or cloud provider whether its firmware includes that fix; an upstream code change does not establish that a deployed machine has received it.

29 October: Cursor Discloses Backdoored Claude Extension

Cursor's 29 October notice identified malicious Anthropic.claude-code extension versions 2.1.312 and 2.1.313 for macOS and Windows in its marketplace. They were available from about 09:27 to 20:35 UTC. Check the extension version separately from the Cursor application version.

The malware sent host details and attempted to install persistent SSH access. Cursor said code errors and missing administrator privileges prevented the tunnel on most hosts, but attacker keys and persistence could remain. It removed the packages and rebuilt the marketplace; affected users still need to follow its persistence-removal instructions.

How Should You Check Exposure and Complete Recovery?

To check exposure to October's incidents, match the affected versions and downloads in vendor advisories against your software inventory and download history. Investigate connected accounts and follow the vendor's cleanup order before rotating exposed credentials from a clean system. A provider restoring service or removing a malicious download does not finish recovery on your systems. Updating software alone cannot remove an attacker's access or undo stolen data.

AI Speeds Up Attacks and Defensive Research

Wiz's PHP research gives a concrete example of what more capable AI changes: the weaknesses had been present for years, but the researchers say frontier models helped them develop and adapt working exploits in hours. Dutch security agencies described the same pressure in their 23 September assessment: "Vulnerabilities are identified and exploited more quickly."

That pressure also reaches systems beyond websites and developer tools. A 9 September US government warning described AI-generated scripts used for reconnaissance and capability development against Siemens industrial controllers. The warning concerns preparations for attacks on industrial systems; it reports no successful AI-caused power-grid outage.

The UK government said on 12 October that frontier-AI pilots had helped identify and fix more than 1,000 potential vulnerabilities across government systems, showing how the same tools can help defenders.

Whether that produces safer systems depends on getting fixes into use. EDK II users still needed to confirm their firmware included the fix, while LiteLLM's breach began with a key exposed months earlier and never revoked.

Does Government Preparedness Advice Warn of an Imminent AI Attack?

Government household preparedness advice covers wider risks, including severe weather, conflict and cyberattacks. It does not establish that governments expect an imminent AI-driven attack.

In a 31 October post, Pieter Levels connected AI-assisted attacks on infrastructure with governments advising households to keep food and water reserves. Most of the recommendations he listed are real, although several were issued years before this month's incidents.

The EU recommended at least 72 hours of essential supplies in March 2025, Norway increased its advice to one week in May 2024, and Germany recommends ten days of food and drink. Even the UK's 22 October 2026 campaign says much of its advice has remained unchanged since May 2024.

The checklists do not amount to a blanket instruction to buy a generator. Check your local authority's advice for your household.

For developers and site owners, the work continues beyond October: finish the recovery checks, keep usable backups and limit what applications and agents can access. More capable AI may uncover more weaknesses, but this month's incidents also show the damage an old, unrevoked credential can still do.

Coverage through 31 October 2026; sources checked on 2 November 2026.