October 2026 Hacks: 15 Checked, What Really Happened

A post doing the rounds sums up October 2026 in fifteen lines: "PHP got hacked, Railway got hacked, OpenCode got hacked, Binance got hacked…", ending with "happy cybersecurity awareness month". Most lines point at a real October incident. "Got hacked" fits only some of them. We checked each one against the organisation's own notice, advisory or post-mortem first, then reputable outlets. Seven are confirmed breaches of the named organisation's own systems. Six are breaches of a vendor, a marketplace listing or a campaign that used the platform. One is a vulnerability, not a breach, and one is several unrelated incidents under one label.

Who this is for: security leaders asked "were we exposed to any of these?" this week, and anyone who runs AI provider keys, CI pipelines or developer platforms.

Independent analysis. PlayCISO is not affiliated with any organisation named. Facts are as published by 13 November 2026 and may change. The Sources section says which pages we read and which we saw only in search results.

The fifteen, one line each

Confirmed breaches of the named organisation

Railway

Railway says an attacker created dummy accounts on 18 October, partly escaped isolation in its multi-tenant build system at 07:28 UTC on 20 October, and moved through internal systems until it was evicted at 09:24 UTC on 21 October. Railway detected it at 13:58 UTC on 20 October. Per Railway's incident report, the attacker obtained 353 build histories, a copy of the internal monorepo, short-lived cloud credentials through a misconfigured OIDC binding, and a long-lived decryption credential that was used to decrypt customer environment variables. Railway's upper bound is 1.85% of about 100,000 workspaces, plus linked-account tokens (bring-your-own AI keys and GitHub OAuth tokens) for 1,852 users, and it estimates about $740,000 of unauthorized AI token spend. Railway believes the goal was AI provider keys, and says it has "no evidence that customer databases were accessed".

Railway's advice: rotate every credential stored on Railway before 21 October (AI provider, cloud, database and payment keys first), re-authenticate CLI, CI and GitHub connections, remove public network access to databases, review GitHub and container-registry audit logs, redeploy your latest commit, and report unauthorized AI charges through Railway's form.

OpenCode (the hosted Console)

OpenCode says there was unauthorized access to "a legacy system that we were in the process of decommissioning", and that third-party AI provider keys (OpenAI, Anthropic, Google) stored in Console workspaces may have been exposed. It linked the attack to "a large-scale distillation attack that impacted 1.4% of OpenCode Console users" (OpenCode on X, as quoted by Infosecurity Magazine). The earliest possible exposure was 00:30 UTC on 17 October. A co-founder said it was the Console, not the open-source OpenCode agent. OpenCode has not published a count or a root cause. Its own advice: "If you did not get an email you were not impacted." If you did, replace and revoke every key you ever stored in Console and check provider billing from 16 October.

Binance

Binance said about $6.3 billion was drained from Binance.com hot wallets across ten blockchains on 29 October, most of it within about twenty minutes, and warned the figure "may continue to increase" (per Al Jazeera). Binance says it "will absorb the financial impact of the stolen funds, not our users", that about $3 billion was frozen (including more than $2.3 billion by Tether and Circle, per Reuters) and that about 95% of the amount had been replenished by 1 November, when withdrawals reopened in phases. Binance first pointed to a compromised engineer's laptop and later said it found "additional points of breach". TRM Labs and Chainalysis attribute the theft to North Korea's TraderTraitor; that is an analyst attribution, not a government one. Binance.US and Coinbase say they were not affected. Our Binance post covers how the attacker moved the funds.

Fireworks AI

Fireworks says it detected unauthorized use of its internal credentials on 6 October; environment variables used in evaluation jobs in "a limited number of customer accounts" were captured, including API keys and tokens stored as secrets. Keys were revoked and rotated on 9-10 October. In an update dated 9 November, Fireworks says a third-party cloud provider hosting its R&D machines had a security incident on 23 October, and on 24 October the attacker reached Fireworks development machines. Accessed: resource metadata, billing information, and for a limited set of accounts secrets, datasets and "a subset of incomplete model weights". Fireworks says payment card numbers are not stored and were not affected, and attributes the attack to a financially motivated group selling stolen LLM access. Downstream, Notion says AI chat transcripts from fewer than 1% of its workspaces were exposed through the vendor.

Fireworks' advice: create new API keys, rotate any third-party credentials named in your notice with the issuing provider ("Removing a stored secret alone does not invalidate the underlying credential"), and review access logs.

LiteLLM

This is the second LiteLLM supply-chain attack of 2026; our earlier post covers the March one. LiteLLM's root-cause analysis says an admin key committed to a public repository in May 2026 was never revoked. On 10 October the attacker used it to reach an internal deployment and take an org owner's unscoped GitHub CLI token, then stole other maintainers' tokens, pointed the release workflow at a lookalike fork, passed the two-person release gate with the stolen tokens and deleted the run records. On 21 October a malicious litellm 1.107.0 was published to PyPI (seven wheels, quarantined by 13:23 UTC) and to the official Docker Hub and GHCR images (removed or repointed by 14:20 UTC). LiteLLM says it "contained compiled malware which steals credentials and loads remote-code execution tools", and that the payload runs whenever Python starts, even if LiteLLM is never imported. The GitHub source tag was clean.

LiteLLM's advice: treat any host that started Python with 1.107.0, or ran the bad Docker digest, as compromised; remove the malicious files, reinstall pinned to 1.106.2 (ideally rebuild), and rotate the instance role, every provider key in the proxy database, master and virtual keys, the database password and every secret on the host. The bad images were signed with the old cosign key, so a valid signature alone does not prove an image is clean.

Capcom

This is a new incident, not the 2020 ransomware attack. Per INCIBE-CERT's summary of Capcom's notice, Capcom detected unauthorized access to CAPCOM ID, its player account system, on 19 October, found on 20 October that customer data had leaked and that some passwords had been changed, reported it to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on 21 October, and published notices on 22 and 23 October. Data taken: email addresses, account creation and last-access dates, login counts and last-login IP; in some cases date of birth, gender, country and alias; for some e-Capcom accounts, personal and purchase data. Capcom says no card details were compromised. The count reported from Capcom's notice is 11,774,247 records. Counts of accounts with changed passwords differ between outlets, so we do not repeat one. Expect phishing that uses the leaked details.

PingCAP (TiDB Cloud)

PingCAP says "an unauthorized party used stolen service account credentials" to access certain internal systems, including production systems, from 9 September to 7 October 2026. The attacker took source code and exported TiDB Cloud account and usage data (user names, emails, organisation and project links, SQL editor text and errors), business and billing data, and a table of encrypted TiDB Cloud API-key values. PingCAP says "there is no evidence that data stored in TiDB was impacted", and that it will contact affected customers directly. A 10.6 TB figure comes from the group claiming the attack; PingCAP's report does not support it. Rotating TiDB Cloud API keys and any credentials shared with PingCAP support is the prudent step.

Breaches next to the named company

Polymarket: a third-party provider

Polymarket said on 29 October: "One of our third party providers was compromised, and we have referred this to relevant law enforcement" (per The Block). User funds were drained to an attacker wallet; Polymarket put its international exchange into cancel-only mode, found the cause and resumed the same day, and said it is "fully reimbursing all affected traders" (per AP). Polymarket has not named the provider or published a total. Reuters, citing one person familiar with the matter, named the UK performance-monitoring firm DebugBear, which said it was "impacted by an ongoing security incident" and told clients to remove its embed code. Loss figures in coverage range from about $2.5 million to more than $3 million.

Coinbase: its analytics vendor Amplitude

Coinbase Support said that "Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers", with "no evidence of unauthorized access to Coinbase systems" and no impact on funds (per PYMNTS, 27-28 October). Coinbase gave no count; "over 70,000 users" comes from the security firm SlowMist and is unconfirmed. We found no statement from Amplitude. Coinbase's 29 October 8-K is its Q3 earnings filing and does not mention the incident. This is not the 2025 support-agent bribery breach. If you are a Coinbase customer, expect targeted phishing.

Warp: a vendor

Warp's CEO Zach Lloyd described "an active and narrow-banded exploitation of a vendor in Warp's infrastructure" that exposed AI agent decision logs (agent traces) and user telemetry, and said "roughly 1% of Warp users may have been impacted", an upper-bound estimate (reported by BleepingComputer on 27 October). Warp says it notified affected users, engaged CrowdStrike and informed law enforcement. It has not named the vendor or said whether the logs held source code, prompts or credentials. If you were notified, rotate any secret that passed through an agent session.

GitHub Actions: the GhostAction campaign

Attackers used stolen maintainer accounts to push a fake "Security Audit" workflow (file names security-audit.yml, github_actions_security.yml, security-check.yml) into repositories. The workflow sent the repository's Actions secrets, and credentials mined from the whole Git history, to the attacker's server. StepSecurity reported the main push on 8 October and disclosed on 9 October; it counts 345 repositories swept on 8 October. Socket reports more than 500 accounts since 7 October. GitGuardian saw the workflow in 772 public repositories between 31 August and 30 September. GitHub's own platform was not shown to be breached, and we found no GitHub advisory. The victims are the account owners and the projects whose secrets were taken. A separate, larger campaign followed in November: see our wfx-loot post.

What researchers advise: search your repositories for those file names since 31 August 2026 and treat a hit as a compromise; revoke the hijacked token or session; rotate every secret the history sweep could reach; delete the workflow from all branches and forks; hold releases until clean. Our GitHub Actions security auditor checks a workflow file for the risky patterns.

Cursor marketplace: a trojanized extension

A malicious build of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313, Windows and macOS) was published in Cursor's extension marketplace under Anthropic's publisher identity and was live on 29 October from about 02:27 to 13:35 PT. It added an attacker SSH key labelled svc-telemetry, set up persistence and a reverse tunnel, and sent host details. Anthropic says the build was "not developed by Anthropic" and its own systems were not compromised; the official VS Code Marketplace and Open VSX were not affected. Cursor shut down and rebuilt the marketplace and says no other extensions were tampered with; it has not said how the extension was published. Cursor's advice includes checking for the svc-telemetry key and noting that "uninstalling the extension may not be sufficient". Full detail is in our Cursor and Claude Code post.

SoftBank: ransomware at IDC Frontier

SoftBank's cloud subsidiary IDC Frontier says ransomware hit IDCF Cloud's Tokyo East Region 1 from about 03:40 JST on 7 October. Virtual servers stopped and could not be restarted, data in those zones is hard to recover, and customers must restore from their own backups. Coverage puts the number of affected companies and local governments at 495. IDCF reported it to supervisory authorities and the Tokyo Metropolitan Police. Figures about encryption speed and backup volumes come from the attacker's ransom note and are claims. Separately, SoftBank Corp. said that on 17 October there was "an unauthorized access attempt" against some systems behind My SoftBank and suspended the web versions; it has not confirmed any data leak. SoftBank Group's own systems are not reported as breached.

Wrong frame or too broad

PHP: a vulnerability, not a breach

Nothing shows php.net or the PHP project was breached. On 21 October PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (with source backports for 7.4, 8.0 and 8.1) to fix CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell, each rated CVSS v4.0 9.2: flaws that can let an attacker run code on a server with no login, with the highest risk under mod_php. PHP says there are no complete mitigations and to update immediately; a 23 October advisory adds setting session.upload_progress.enabled=0 as a precaution. Exploitation in the wild is reported by outlets (BleepingComputer's headline says the flaws are now exploited), not by PHP.

npm: several compromises, not one wave

We found no single big npm worm wave dated to October 2026; the large named waves were earlier in the year. October had several separate incidents. The Hacker News reported that tensorlake 0.5.144 (a TypeScript SDK) was compromised on 7-8 October with a self-spreading credential stealer that also wipes the home directory if its stolen token is revoked; the version has been removed. StepSecurity reported a credential stealer in @subql/common 5.8.3 on 5 October. Socket reported two Namastex Labs packages compromised by the CanisterWorm campaign around 17 October. Separately, researchers reported a flaw in npm Trusted Publishing that could have let attackers publish to more than 1,500 packages through reclaimed abandoned GitHub repository names; that is an exposure, not a confirmed compromise. Our npm supply chain tracker follows these.

The pattern: keys, not data, were the prize

Read together, most of these incidents ended the same way: someone walked out with long-lived keys. AI provider keys at Railway, OpenCode, Fireworks and LiteLLM; CI secrets in GhostAction; maintainer tokens at LiteLLM; service account credentials at PingCAP. Railway, OpenCode and Fireworks each describe the motive as reselling AI access or distilling models. A breached platform you trusted with a key is now a breach of your key. That is the hub-and-spoke pattern one responder describes in Black October: lessons from the downstream breaches.

What security leaders should do this week

• List where your keys live. For each platform above you use (Railway, OpenCode Console, Fireworks, LiteLLM, TiDB Cloud, Warp, Polymarket integrations), list every credential stored there and rotate it at the issuing provider, not just in the platform.
• Check AI provider billing from mid-October for spend you did not make; several of these attacks were about resold AI access.
• Search your GitHub organisation for the GhostAction workflow file names and for workflows added by unexpected accounts since 31 August.
• Pin and verify dependencies. Check lockfiles for litellm 1.107.0, tensorlake 0.5.144 and @subql/common 5.8.3; treat a hit as a host compromise, not an upgrade.
• Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later.
• Check developer machines that run Cursor for the svc-telemetry SSH key.
• Replace long-lived keys with short-lived ones where the platform supports workload identity or OIDC; restrict what remains by network where you can.
• Ask your vendors the third-party questions: which of your secrets they hold, how they are encrypted, and how fast they would tell you. Our third-party breach response checklist has the list.

FAQ

Was PHP hacked in October 2026?

No breach of php.net or the PHP project has been reported. On 21 October PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619 (nicknamed PHP2Shell), each rated CVSS v4.0 9.2, that can let an attacker run code on a server with no login. PHP says there are no complete mitigations and to update immediately. Exploitation in the wild is reported by outlets such as BleepingComputer, not by PHP.

What happened in the Railway security incident?

Railway says an attacker partly escaped isolation in its multi-tenant build system on 20 October, moved through internal systems and used a long-lived credential to decrypt customer environment variables. Railway gives an upper bound of 1.85% of about 100,000 workspaces, plus linked-account tokens for 1,852 users. It evicted the attacker on 21 October and says it has no evidence customer databases were accessed. It asks customers to rotate every credential stored on Railway before 21 October.

How much was stolen in the Binance hack?

Binance said about $6.3 billion was drained from Binance.com hot wallets on 29 October, and warned the figure could rise. Binance says it will absorb the loss, not users, and reopened withdrawals in phases from 1 November. TRM Labs and Chainalysis attribute it to North Korea's TraderTraitor; no government has confirmed that.

Was GitHub hacked in October 2026?

No breach of GitHub itself was reported. The GhostAction campaign used stolen maintainer accounts to push a fake "Security Audit" workflow into repositories, which sent the repos' Actions secrets and credentials found in Git history to the attacker. StepSecurity, Socket and GitGuardian reported it; their counts differ. Search your repos for security-audit.yml, github_actions_security.yml or security-check.yml added since 31 August 2026.

Was Coinbase hacked in October 2026?

Coinbase says it was not. Coinbase Support said its analytics vendor Amplitude had a security incident that touched a small subset of Coinbase customer contact data, with no evidence of unauthorized access to Coinbase systems and no impact on funds. Coinbase gave no count; a figure of over 70,000 users comes from a blockchain security firm and is unconfirmed. This is separate from the 2025 support-agent bribery breach.

What should I do if I used LiteLLM 1.107.0?

LiteLLM says to treat any host that started Python with 1.107.0, or ran the compromised Docker digest, as compromised. Remove the malicious files, reinstall pinned to 1.106.2 (ideally rebuild the host), and rotate the instance role, every provider key in the proxy database, master and virtual keys, the database password and every secret on the host. A valid cosign signature alone does not prove an image is clean.

Was TiDB Cloud hacked?

PingCAP says an unauthorized party used stolen service account credentials to access some of its internal systems from 9 September to 7 October 2026, took source code and exported TiDB Cloud account and usage data, business and billing data, and a table of encrypted TiDB Cloud API-key values. PingCAP says there is no evidence that data stored in TiDB was affected. A 10.6 TB figure is an attacker claim that PingCAP's report does not match.

Sources

Primary documents first. "Read" means we opened the page; "via search" means we saw it only in search results or as quoted by an outlet.

• Railway: incident report, October security incident (read); Railway changelog, 23 Oct (read)
• PHP news archive 2026 (releases and advisories; read)
• LiteLLM: root-cause analysis, 21 Oct incident (read); LiteLLM: initial post (read; some early claims later corrected)
• Fireworks AI: October 2026 security incident (read); Fireworks AI: update (read)
• PingCAP Trust Hub: security update, October 2026 (read)
• Cursor: Claude Code extension security notice (read)
• Binance Square: 1 Nov update (read)
• IDC Frontier: notice of 8 Oct (Japanese; read); SoftBank Corp. press release, 19 Oct (Japanese; read)
• INCIBE-CERT: unauthorised access to CAPCOM ID (read); Capcom's own notices of 22 and 23 Oct could not be opened
• StepSecurity: GhostAction returns (read); The Hacker News: credential-stealing GitHub Actions (read)
• Infosecurity Magazine: OpenCode breach (quotes OpenCode's posts on X; read)
• Al Jazeera: Binance says $6.3bn stolen (read)
• The Block: Polymarket exploit (read); AP via NY1: Polymarket paused international trading (read)
• PYMNTS: Coinbase customer data exposed in vendor's breach (quotes Coinbase Support; read)
• Cloud Security Alliance: Warp telemetry breach note (read); BleepingComputer's Warp report (via search; could not be opened)
• The Hacker News: Fireworks AI breach widens (Notion impact; read)
• The Hacker News: Claude Code extension in Cursor (read)
• The Hacker News: tensorlake npm package compromised (read); StepSecurity: SubQuery packages (via search)
• SDxCentral: SoftBank cloud arm attacked (read; encryption-speed figures are the attacker's claim)

Share: #CyberSecurityAwarenessMonth #DataBreach #SupplyChainSecurity #Cybersecurity #Infosec #ThirdPartyRisk #FactCheck #AISecurity

This article is general information, not legal or security advice. Follow your vendors' and national authorities' guidance.