CriticalAPT
Hacktober – Cyberattack Wave Hits PHP, Node.js, Binance, LiteLLM, Pentagon, and a Few More
Cyber Security News·Source published ·1 min read
What happened?
October brought a heavy run of cybersecurity disclosures involving cryptocurrency exchanges, web servers, AI tools, software packages, government records, and grocery chains. Binance investigated billions of dollars in unauthorized transactions, PHP issued emergency fixes, and a malicious LiteLLM release put developer credentials at risk. Other incidents involved Railway, OpenCode, Polymarket, Coinbase, Cursor, eMudhra, and Capcom. Together, these reports show how exposed credentials and trusted software channels can turn a limited intrusion into a much larger security problem.
Key details
- Polymarket browser JavaScript searched storage for trading credentials and attempted to reach an active client.
- Coinbase vendor exposure involved Amplitude analytics provider exposing customer contact information.
- Node.js October updates addressed ten vulnerabilities including Brotli decompression memory corruption.
- LiteLLM version 1.107.0 reached PyPI with a credential stealer and remote access malware across all wheel files.
- GhostAction campaign placed malicious workflows in 790 GitHub Actions repositories exposing cloud credentials.
Affected
- PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are fixed releases for PHP2Shell.
- Node.js 26.12.1, 24.22.1, and 22.23.4 are patched releases for Node.js vulnerabilities.
- LiteLLM PyPI package users and container tag consumers were affected by credential stealer.
What to look for
- PHP server code execution via mod_php module before application code ran indicates exploitation.
- Node.js Brotli decompression memory corruption and TLS hostname validation issues reported.
- LiteLLM credential stealer searched for cloud credentials, SSH keys, and AI service tokens.
- GhostAction malicious workflows put cloud credentials and publishing tokens at risk.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.