Hacktober 2026 wave of cyberattacks hits Binance, PHP, Node.js, and LiteLLM
Original title: Hacktober 2026: Major Cyberattacks Hit Binance, PHP, Node.js, LiteLLM, and Pentagon
Binance reports $6.3B unauthorized transactions while PHP and Node.js vulnerabilities are fixed and the Pentagon breach affects millions.
October cybersecurity disclosures spanned cryptocurrency platforms, developer infrastructure, and government records under the Hacktober name. Binance investigated $6.3 billion in unauthorized transactions with blockchain partners freezing $3 billion and no evidence of wallet private key leaks. PHP2Shell exploited two CVEs enabling unauthenticated code execution; fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Node.js addressed multiple high-severity issues in releases 26.12.1, 24.22.1, and 22.23.4. LiteLLM version 1.107.0 distributed credential-stealing malware via wheels and images.
Unconfirmed: Binance has not confirmed the $2.7M Polymarket figure; scope of some incidents remains unconfirmed.
- Binance reports $6.3B unauthorized transactions
- PHP2Shell CVEs fixed in PHP 8.2.35+ releases
- Node.js releases 26.12.1, 24.22.1, 22.23.4 address vulnerabilities
- LiteLLM 1.107.0 distributed credential-stealing malware
- CAPCOM ID breach exposed 11.7M records
| Product | Affected | Fixed in |
|---|---|---|
| Binance cryptocurrency platform | — | — |
| PHP | — | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
| Node.js | — | 26.12.1, 24.22.1, 22.23.4 |
| LiteLLM | 1.107.0 | — |
| CAPCOM ID system | — | — |
- 1.upgrade to PHP 8.2.35 or later
- 2.deploy Node.js releases 26.12.1, 24.22.1, or 22.23.4
- 3.rotate exposed credentials
- Malware
- credential-stealing malware
- Countries
- United StatesDenmark
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
2 min read at gbhackers.com
October’s cybersecurity disclosures spanned cryptocurrency platforms, developer infrastructure, certificate authorities, government records, gaming accounts, and retail operations. Dubbed Hacktober, the wave included unrelated incidents rather than a single coordinated campaign.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.