I have to say October has been a good month for cybersecurity professionals job security...

  • Railway - Potential exposure of customer environment variables and secrets.
  • LiteLLM - Compromised v1.107.0 distributed credential-stealing malware through PyPI and Docker releases.
  • Zeabur - Infrastructure breached, exposing internal credentials, customer secrets, and platform data.
  • OpenCode - Console breach exposed users’ AI provider API keys.
  • OVHcloud CLI - Official GitHub release binaries replaced with malicious versions.
  • Rank Math PRO - Malware inserted into some official v3.0.123 plugin downloads.
  • TeamUpdraft - Security breach exposed customer connection keys capable of accessing connected WordPress sites.
  • ConnectWise - Compromised Cloud Backup credentials used to access customers’ Microsoft 365 environments.
  • Tensorlake - Hijacked npm release distributed credential-stealing malware.
  • SubQuery - Backdoored @subql/common npm package stole credentials and enabled remote shell access.
  • GhostAction - Compromised GitHub repositories injected with malicious workflows targeting secrets.
  • PHP - Critical remote code execution vulnerabilities prompted emergency security updates.
  • Node.js - Security updates released for Node.js 22, 24, and 26, including dependency fixes.
  • eMudhra - Private keys for eight intermediate certificate authorities compromised.
  • Tailscale - Security update issued to distrust compromised eMudhra certificates; WireGuard node-to-node encryption remains unaffected.