Hacktober 2026: PHP2Shell, Node.js and LiteLLM fixes, Binance probe

What happened

Two outlets describe October 2026 as a heavy run of disclosures, nicknamed “Hacktober”. Both stress that these were unrelated incidents, not one coordinated campaign, and that confirmed theft, possible exposure, malicious packages and vulnerable configurations must be kept apart (Cyber Security News, GBHackers). The items most relevant to developers:

• PHP2Shell. It involves two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, both scored 9.2. Cyber Security News reports memory-handling flaws that could allow unauthenticated code execution under vulnerable configurations, with a demonstrated path through Apache’s mod_php. It also reports that AWS saw exploitation attempts before public disclosure, and that later reporting separated scanning and failed attempts from evidence of successful compromise in another environment (Cyber Security News). GBHackers likewise says attempts should not be equated with confirmed compromises (GBHackers).
• Node.js. Ten vulnerabilities were addressed, four rated high severity, involving Brotli decompression memory corruption, TLS hostname validation and DNS handling (Cyber Security News).
• LiteLLM. Version 1.107.0 reportedly reached PyPI with a credential stealer and remote access malware in all seven wheel files, and affected container tags widened the exposure. The code searched for cloud credentials, SSH keys, browser information and AI service tokens, and Python startup hooks meant it could run without LiteLLM being imported. Stolen AWS credentials were reportedly used within roughly four and a half hours (Cyber Security News).
• GhostAction, npm and Cursor. GhostAction placed malicious workflows in 790 repositories, putting cloud credentials, publishing tokens and AI keys at risk. Both outlets say this does not show GitHub’s central platform was breached. A separate npm trusted-publishing weakness exposed more than 1,500 packages to possible takeover, which is not confirmed malware in each package. Cursor confirmed malicious Claude Code extension packages in its marketplace (Cyber Security News, GBHackers).
• Stored secrets. Railway disclosed possible unauthorized access to customer environment variables, including some decrypted values, paused deployments and advised customers to rotate secrets. OpenCode said 1.4% of Console users were affected, with possible exposure of third-party API keys; GBHackers adds that extraction remained unconfirmed (Cyber Security News, GBHackers).
• Other items. Binance investigated unauthorized transactions reportedly totaling $6.3 billion, with about $3 billion frozen, and said it found no evidence that wallet private keys leaked. Polymarket investigated malicious JavaScript; an outside analysis linked at least $2.7 million in withdrawals to 710 wallets, which Polymarket had not confirmed. Coinbase’s vendor Amplitude exposed some customer contact information, and Coinbase said its systems and funds were not affected. eMudhra had eight intermediate CA private keys that were recoverable because of weak key generation; browser and OS vendors blocked the certificates, and eMudhra said its infrastructure was not compromised. Capcom ID exposed 11,774,247 records, per GBHackers (Cyber Security News, GBHackers).

Fireworks AI, TiDB Cloud and Warp were named in the roundups, but their incident scopes are not confirmed in these sources. The Pentagon, Denmark, SoftBank, Ahold Delhaize and French refrigeration items are only briefly covered; GBHackers notes that the Pentagon access ran from October 2025 to July 2026 and that corroboration of the refrigeration reports was limited.

Am I affected?

• PHP: you are potentially affected if your PHP runtime is older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12 on its branch. A patched CMS does not help if the runtime is vulnerable, and running workers must load the corrected build (Cyber Security News). Which configurations are vulnerable beyond the mod_php path is not confirmed.
• Node.js: you are potentially affected if the runtime in your deployed images is older than 26.12.1, 24.22.1 or 22.23.4. Updating a laptop or a server default does not replace a runtime bundled in a separate image.
• LiteLLM: you are affected if version 1.107.0 or an affected container tag was installed or built into any environment, including build jobs.
• Railway, OpenCode, GhostAction, Cursor: you are potentially affected if you are a customer or user of these platforms, had repositories targeted, or installed the named extension packages. Exposure is described as possible, not confirmed for every user.
• Other items (Binance, Polymarket, Coinbase, eMudhra, Capcom) concern those companies’ own users and systems.

What to do now

1. Inventory PHP and Node.js runtimes, including those inside container images, and update to the fixed releases listed above. Restart workers so the patched build is loaded.
2. Check whether LiteLLM 1.107.0 or its affected container tags were used anywhere. If so, replace the software and rebuild from a trusted source. Cyber Security News says credentials available to the affected environment should be treated as potentially stolen, so review and rotate cloud credentials, SSH keys and AI service tokens there as a precaution. A downgrade alone does not undo the exposure. A fixed LiteLLM version is not confirmed in these sources.
3. If you use Railway, follow its advice to rotate secrets stored in environment variables. If you use OpenCode Console with linked external providers, consider rotating those third-party API keys.
4. Review GitHub workflows for unexpected changes, and consider rotating any cloud, publishing or AI keys they could reach.
5. Review the Cursor extensions you have installed for the malicious Claude Code packages. The package names are not confirmed in these sources.
6. Keep confirmed theft, possible exposure and attempted exploitation separate in your own incident notes, as both outlets recommend.

Sources

• Cyber Security News: Hacktober - Cyberattack Wave Hits PHP, Node.js, Binance, LiteLLM, Pentagon, and a Few More
• GBHackers: Hacktober 2026: Major Cyberattacks Hit Binance, PHP, Node.js, LiteLLM, and Pentagon