The last 10 days of October are considered a "nightmare" in the field of cybersecurity, with a series of recorded vulnerabilities and system intrusions.

Guardian and Business Insider both call this "dark October", while many other experts warn that things are actually just getting started.

PHP2Shell, the common name for two serious vulnerabilities CVE-2026-109618 and CVE-2026-109619 in the PHP programming language, quickly became the target of exploitation campaigns, after information was leaked on October 21. Both allow hackers to remotely execute code on any PHP server without authentication, making it easier for bad guys to steal data and read sensitive information.

Both were discovered with the help of AI, showing that this technology is increasingly capable of finding undiscovered security weaknesses, even in complex software systems.

PHP currently operates about 70% of websites on the Internet, making the scope of impact especially large. According to Palo Alto Networks, 22.6 million servers are at risk. By October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) included two vulnerabilities in the list of actual exploited weaknesses. Some experts also rate PHP2Shell as the most serious security issue that PHP has faced in over a decade.

Famous Japanese Internet company GMO announced on October 25 that it had been attacked by hackers, potentially affecting 26,739 servers. The problem was discovered on October 19 and on October 21, hackers demanded $50 million in ransom, threatening to publicize customer data, causing risks to about 20 businesses using GMO's services.

Instead of negotiating, GMO CEO Masatoshi Kumagai refused to pay the ransom, requiring users to scan for malicious code, back up data and disconnect computers to limit damage. The incident also affected a number of customers in the foreign exchange trading sector, with cases of tens of thousands of dollars in losses.

GMO mobilized about 200 cybersecurity experts, coordinating with security and AI companies to find the culprits. On October 29, GMO CEO said he had the first clue to help identify the group behind it. He also warned that open source AI is helping people without expertise easily develop tools to exploit vulnerabilities.

Railway and LiteLLM

On October 20, Railway, a cloud application deployment platform, recorded hackers gaining unauthorized access to part of its internal system, potentially exposing API keys and customer authentication information. On October 21, the company advised users to replace private keys and review unusual activities to limit damage.

On the same day, LiteLLM, an open source library that connects applications to many AI models, became the target of a software supply chain attack. Hackers spread version 1.107.0 containing malicious code on the PyPI repository and Docker repositories. The malware is capable of stealing login credentials, API keys, and sensitive data in development environments. The malicious package persists for about two hours before being removed.

Although quickly fixed, TechCrunch assessed the two incidents as showing that hackers were targeting application deployment platforms and software libraries to access multiple systems at the same time. With a stolen API key, an attacker can illegally access AI services, hog cloud resources, or incur unexpected costs.

More than 40,000 DHS employee records exposed

The non-profit organization Distributed Denial of Secrets (DDoS) said on October 28 that the system of the US Department of Homeland Security (DHS) had been infiltrated. The stolen data contained the names, titles, phone numbers, emails, and office addresses of more than 40,000 employees, including DHS units such as Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security (HSI), Cybersecurity and Infrastructure Security Agency (CISA).

According to AFP, the hacker group Department of Peace created a tool called Icepick, which helps search for employee names, offices and tasks. According to TechCrunch, hackers took data from Okta's single sign-on system, which is used by DHS to allow employees and contractors from different agencies to log into the central network.

Old security vulnerability on Synology NAS

On October 28, users in Korea, Taiwan, Vietnam... noticed that data on Synology's network storage device (NAS) was suddenly encrypted. The file name is changed to the .L0CK3D extension or the .LOCK3D variant, making it impossible to open in the normal way. The attacker left a file demanding a ransom payment in Bitcoin, threatening to double the amount if the victim did not pay within 5 days.

According to Chosun, the attacked devices mainly ran old versions of the DiskStation Manager (DSM) operating system, which had not been patched for two vulnerabilities that had been fixed since 2024. Analysis by Chinese cybersecurity company Qihoo 360 showed that hackers successfully exploited the vulnerabilities to compromise the devices, then deployed the Cerber ransomware variant.

On the same day, Synology's Product Security Incident Response (PSIRT) team confirmed a threat targeting devices running old versions of DSM, with the goal of encrypting data to blackmail users. The team also noted the impact from the PHP2Shell vulnerability, but said the scope of impact was limited to systems using certain PHP dependent packages.

22 vulnerabilities in WordPress

Also on October 28, WordPress - open source web content management code - released version 7.1.4, fixing 22 security vulnerabilities, including a serious error that could allow hackers to remotely execute code on the server without account authentication. The development team recommends that administrators update the website immediately to limit the risk of being attacked.

Specifically, the vulnerability appears in the WordPress update process. During a short period of time while the system decompresses, an attacker can exploit the temporary path to execute code on the server. According to Wordfence, hacker groups have begun scanning the website for exploitation opportunities.

In addition to remote code execution errors, the update also addresses many errors related to XSS attacks, denial of service, information disclosure, and access authorization.

On October 29 (morning of October 30, Hanoi time), Binance said that hot wallets, which are digital currency wallets that are always directly connected to the Internet, of the exchange were attacked with an estimated stolen amount of about 6.3 billion USD. Previously, blockchain analysis platform Arkham Intelligence said that wallets involved in the incident had transferred assets worth $5.78 billion, including Bitcoin, Ether and many other digital currencies.

Binance said the issue may have originated from a compromised DevOps employee's computer. The exchange affirmed that it has not found evidence of the private key of the exposed wallet and that user assets are still safe, and announced that it will use the SAFU user asset protection fund and company resources to compensate for all losses.

According to experts, this is the largest hack in the history of digital currency exchanges, many times the damage that Bybit encountered in February 2025 when hackers took away about 1.5 billion USD in digital currency. Stablecoin issuers are intervening to prevent the continued flow of stolen funds, such as Tether freezing more than $1.56 billion worth of USDT, and Circle freezing more than $800 million USDC related to the incident.

Bao Lam summary

• Binance was hacked, transferring about 6 billion USD worth of digital currency
• Three billion-dollar hacks caused a stir in the cryptocurrency world
• The tug of war between famous Internet companies and hackers
• AI cyber attack era: 'Will experience the feeling that the sky is about to fall'