Skip to main content

Cybersecurity's Dark October

ยท 10 min read
Hong Bao Ngan
Hong Bao Ngan
The creator of the 404 bug

More than 20 breaches in 31 days. The largest crypto heist in history. A ransomware wave that reached NAS devices in Vietnam. And one common thread that is more worrying than any single number.

A month without a quiet dayโ€‹

If you work in IT, October 2026 was probably the month you read security news the most. Almost every morning brought a new name: PHP, Railway, OpenCode, Binance, Polymarket, GitHub Actions, SoftBank, Cursor Marketplace, LiteLLM, Capcom, TiDB Cloud, Chainalysis. Then came banks in South Korea and India, Synology NAS owners, and finally companies in Vietnam.

But reading the list alone misses the most important point. Most of these attackers did not break down the front door. They walked in through an engineer's laptop, an access key nobody revoked, an open-source library, an unpatched NAS, or a partner.

This piece covers the most significant incidents, draws out three recurring patterns, and ends with a checklist any organization can start on this week.

Binance: $6.3 billion in about 20 minutesโ€‹

On the evening of October 29, 2026, an attacker drained about $6.3 billion from Binance hot wallets across roughly ten blockchains. Most of it left in about 20 minutes, starting at 20:05 UTC. It is the largest crypto theft on record, roughly four times the $1.5 billion Bybit hack of February 2025.

The lesson is not the number. According to Binance, the starting point was a compromised DevOps laptop. Not an exotic cryptographic flaw, not a leaked wallet key. Just the work device of one person with high privileges.

Blockchain analytics firms TRM Labs, Chainalysis and Elliptic attribute the theft to TraderTraitor, a North Korea-linked group. As of October 30, no government had confirmed attribution. The attacker had prepared for at least 36 hours, including test runs against Binance wallets.

The industry reacted fast. Tether, Circle, Ripple and other partners froze about $3 billion. Binance set aside more than $6.34 billion to cover user losses.

The lesson for everyone outside crypto: the devices of administrators, DevOps engineers and IT admins are the highest-risk assets in any organization. If the laptop of the person holding the keys is not managed more strictly than everyone else's, you share Binance's weakness, just at a smaller scale.

The software and AI supply chain: the new back doorโ€‹

If Binance was the biggest story in dollars, the supply chain incidents are the most worrying story for the long term. October's list includes the PHP2Shell vulnerability, GitHub Actions, multiple npm packages, Cursor Marketplace, and a string of AI and developer platforms: OpenCode, LiteLLM, Fireworks AI, Railway, TiDB Cloud, and a Warp partner.

LiteLLM: a key forgotten for five monthsโ€‹

LiteLLM is an open-source proxy that routes requests across LLM providers, used widely by AI companies. On October 21, 2026, its release pipeline was hijacked. A malicious version 1.107.0 was pushed to PyPI, Docker Hub and GHCR, carrying a credential stealer and remote-access tooling. The poisoned package stayed on PyPI for about an hour and 44 minutes.

The root cause, per the postmortem: a credential that leaked in May and was never revoked. In October, the attacker used it to reach an internal platform, pulled a GitHub token, and took over the release pipeline. It was LiteLLM's second compromise of 2026, after a separate incident in March.

GitHub Actions, npm and PHP2Shellโ€‹

In October, a malicious npm package with about 206,000 downloads was found targeting repositories owned by GitHub itself to steal tokens. Meanwhile, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a remote code execution flaw in PHP core, put countless web applications at risk, including native packages on Synology NAS.

Why this matters to youโ€‹

Your team may not use LiteLLM, but it almost certainly uses npm, PyPI, GitHub Actions, VS Code extensions, or AI coding plugins. Every library and extension is a supplier you have never assessed. When that supplier is compromised, the malicious code runs with your permissions, inside your pipeline.

Asian banks: attacks with AI assistanceโ€‹

South Korea is the story to watch, because it is the first time a government has publicly said AI was likely used in hacks against its banks. Starting in late September, at least seven financial institutions disclosed intrusions. By October 8, reported exposure had reached about 68,000 customers, and the numbers kept climbing.

  • Daishin Securities: more than 38,000 customers. Attacked on October 17 through its online account-opening server.
  • Shinhan Bank: about 25,000 loan applicants. Names, phone numbers and income data exposed.
  • KB Kookmin Bank: 2,210 people. It first reported 119 on October 2, then added 2,091 more on October 26.
  • Welcome Savings Bank: about 2,200 people, disclosed in early October.
  • Bithumb: about 600 employees. Its internal mobile work system was breached on October 27.
  • Hana Bank: 89 customers, disclosed on October 2.

President Lee Jae Myung ordered a full investigation. Financial authorities logged about 4.4 million attack attempts from North Korean IP ranges since October 21. KB Kookmin publicly apologized for failing to grasp the scale at first: its count grew from 119 to over 2,200 in three weeks.

In India, ICICI Bank reportedly lost about $2 million through an abused connection. Among large enterprises, SoftBank and Capcom were also on October's list.

The lesson: when attackers use AI to scan and exploit, they find the weakest system much faster than before. Banks with solid processes blocked the same attacks; banks with gaps did not. And if you don't know where your data lives, you can't even count what you lost.

Vietnam: no longer someone else's problemโ€‹

Synology NAS encrypted by C3RB3Rโ€‹

This is the incident closest to small and mid-sized businesses everywhere. Since early October, C3RB3R ransomware (a Cerber variant) has been encrypting files on Synology NAS devices, renaming them with a .L0CK3D extension and leaving a bitcoin ransom note in every folder. Victims include users in Vietnam.

On October 29, Synology confirmed the attacks exploit a vulnerability patched back in December 2024, targeting devices on outdated DSM versions. Chinese security firm 360 points instead to two critical flaws (CVSS 9.8) patched on September 18, 2026. Either way, the conclusion is the same: unpatched devices are the main victims.

In many Vietnamese companies, the NAS is both the shared file server and the place backups live. When it gets encrypted, the business loses the original data and the backup at the same time. Snapshots on the same device are not a substitute for an independent backup.

HOCMAI and the local financial sectorโ€‹

HOCMAI, one of Vietnam's largest online learning platforms, is suspected of leaking data on more than 7 million students. At the time of writing, I have not seen official confirmation from the company or authorities, so this should be treated as unconfirmed. Several Vietnamese finance, securities and banking companies were also reportedly attacked.

Student data is a high-value target: it belongs to minors and often includes parents' details, schools and phone numbers. With Vietnam's Personal Data Protection Law now in force, this is no longer only a technical problem but a legal liability.

Three patterns from Octoberโ€‹

Put the incidents side by side and three patterns repeat. None of them needs new technology to prevent. They need governance discipline.

1. Privileged identities and devices are the main way in. A DevOps laptop at Binance. A forgotten key at LiteLLM. GitHub tokens stolen through npm. Attackers don't need to break the firewall when they can borrow the identity of someone already inside.

2. Third-party risk now outweighs internal risk. A Coinbase partner, a Warp partner, npm libraries, extension marketplaces, AI platforms. You control your own systems, but not your supplier's suppliers. What you can do is know who you depend on and limit what they can reach.

3. The patch existed but was never applied. Synology fixed its flaw in December 2024, nearly two years before mass exploitation. It is the most familiar failure and the easiest to fix, if the organization has a real asset and patch management process.

What ties all three together: organizations don't clearly know what they have, who has access to what, and what is still unpatched. That is exactly what standards like ISO 27001 make you answer.

A checklist you can start this weekโ€‹

No big budget needed. Most of this takes an afternoon and one person who owns it.

Devices and patching

  • Check the DSM version on every Synology NAS, update to the latest build, and turn on automatic updates
  • Take NAS devices, firewalls and cameras off direct internet exposure unless truly needed; use a VPN instead
  • List every "set and forget" device (NAS, old servers, routers) with its last update date

Identity and access

  • Enforce MFA on every admin account, preferably phishing-resistant MFA
  • Separate admin accounts from everyday accounts
  • Review and revoke API keys, tokens and accounts belonging to people who left or projects that closed

Backups

  • Keep at least one offline or immutable backup that does not sit on the same device as the original data
  • Run a real restore test, don't just check that the backup job says "success"

Supply chain

  • List the vendors, SaaS tools and AI services that can access company data
  • For dev teams: pin dependencies with lockfiles and scope CI/CD tokens to the minimum

Governance

  • Decide who owns incident response and how to reach them after hours
  • Self-assess against a framework such as ISO 27001 to see where your gaps are

Do you know where your organization stands?โ€‹

October 2026 made one thing clear: no organization is too big to be breached, and none is too small to be ignored. Binance, with thousands of security engineers, still lost $6.3 billion. A 20-person office with an unpatched NAS can lose all its accounting data overnight.

The difference is not whether you get attacked, but how prepared you are. And preparation always starts with an honest assessment of where you are today.

PCS Platform: Compliance & ISO Managementโ€‹

PCS Platform lets you self-assess against ISO 27001 (information security) and ISO 42001 (AI management systems), control by control, so you know exactly where your gaps are and what to fix first.

  • Try it now, no account needed: open your browser and start assessing
  • Sign in to sync: save progress and work across devices

Try it at pcs.io.vn/c

If this was useful, share it with an IT colleague or your manager. A checklist done this week is worth more than ten post-incident analyses.

Sourcesโ€‹