October was a rough month to be responsible for security

People have started calling it Black October. A dramatic name, sure, but the month did stack up a lot of serious security stories in a short window.

The part I keep coming back to is that these weren’t all one kind of attack. Some were software bugs, some were stolen credentials, and one was a crypto exchange losing control of its signing path. The common thread was how much damage a small failure can do when it sits in a critical place.

A week where the supply chain was the target

On 21 October, PHP released emergency fixes for two critical remote-code-execution vulnerabilities, now commonly called PHP2Shell. Amazon later reported an exploitation attempt in its honeypot telemetry dated 17 October, four days before public disclosure (AWS Threat Intelligence). That is a useful reminder that the public announcement is not always the start of the clock.

That same day, a malicious LiteLLM 1.107.0 release briefly reached PyPI and Docker Hub. LiteLLM’s own investigation says an old credential exposed in a public repository led to an organization-owner token, then to access to release workflows. The bad packages were available for a few hours (LiteLLM incident report).

This one hits close to home for anyone building with AI tooling: the compromised package was an AI gateway, but the way in was familiar stuff. A forgotten secret, too much privilege, and a release process that could be redirected.

Then there was Binance

On 29 October, Binance disclosed a major security incident involving its internal wallet-signing service. Its initial report says about $6.34 billion in digital assets were impacted and that roughly $2.85 billion had been frozen or intercepted as of its 3 November update. Binance says it will absorb the loss and had replenished 98% of the affected assets by 31 October; the investigation is still ongoing (Binance’s incident update).

The detail that matters is not just the headline number. The attacker got access to a service that could sign wallet transactions outside the normal withdrawal flow, then used on-chain authorizations that kept working even after Binance suspended withdrawals. That’s a nasty boundary failure: the emergency brake on one system didn’t automatically revoke permissions already granted somewhere else.

It’s not one magical AI super-hack

The month also brought the compromise of private keys for eight eMudhra intermediate certificate authorities. eMudhra says the affected intermediates had not issued publicly trusted end-entity certificates, but browsers and operating systems still had to respond by distrusting certificates in the chain (eMudhra’s statement). People have connected the month to AI-assisted vulnerability discovery, and that may be part of the broader backdrop. But the incidents themselves still mostly read like security engineering under pressure: exposed credentials, software flaws, powerful service accounts, and recovery paths that weren’t independent.

Even the reporting around “Black October” is a little more measured than the name. Axios noted that the feared wave of automated attacks had not materialised in the way some people expected, while security teams were still dealing with a rush of disclosures (Axios).

My takeaway is pretty boring, which is usually a good sign in security: patch quickly, keep secrets out of repos, scope tokens narrowly, and practise restoring the systems you actually depend on. The next flashy exploit will be new. The failure mode probably won’t be.

Figures and incident details reflect the linked updates available on 4 November 2026. Some investigations are still in progress.