October 2026's Software Supply Chain Nightmare: Every Incident, What Was Taken, and What to Do

Developers on X have started calling it Black October. One summed up the month: "October has been an absolute nightmare for software."** The list that followed ran from Railway to LiteLLM to eMudhra, and it was not exaggerated. In three weeks, hosting platforms leaked customer secrets, an AI gateway shipped a credential stealer, official binaries and an official plugin were swapped for malware, npm packages carried worms, tens of thousands of GitHub repositories got malicious workflows, a certificate authority's keys turned out to be guessable, and PHP, Node.js, GitLab and Java all shipped urgent fixes.

The line that closed that post is the right frame: "the biggest security risk might not be the code we write, but the code we trust." This tracker documents every incident with dates, vector, what was taken, what is confirmed and what to do. A pattern section and a single checklist follow.

The tracker

Hosting platforms: secrets in one place

Railway (October 21)

Railway said an unauthorized party "may have accessed encrypted environment variables" and "obtained the decrypted contents" for some. It believes the attack is "part of a series of attacks recently targeting platform companies" aimed at AI inference providers, paused builds platform-wide, rotated storage bucket credentials and invalidated OAuth sessions. It has not disclosed the entry point or how values were decrypted. Full analysis: Railway breach: rotate every secret.

Zeabur (October 14 to 15)

Zeabur's preliminary report says the attacker used internal AWS keys from 01:36 UTC and the shared cluster's admin tokens from 01:40, reaching the platform database. Those long-lived administrator credentials were stored in plaintext in a private configuration repository and "were omitted from rotation following the August incident." Reported exposure: 321,810 accounts and more than 3.2 million environment variable records. The founder announced on October 17 that Zeabur will shut down, winding services down through December 2026. How the attacker first got the credentials, and whether one actor did both breaches, is not established.

The lesson: rotation after a breach has to include the credentials that never appear in an inventory, such as admin tokens in config repositories.

AI tooling: keys are the prize

LiteLLM 1.107.0 (October 21)

All seven PyPI wheels of litellm==1.107.0 were live from 11:39:51 to 13:23 UTC, and the v1.107.0, latest, main-latest and main-stable images on Docker Hub and GHCR were affected. The payload ran from Python's startup hooks, so any Python process in the environment ran it even if LiteLLM was never imported. It stole browser, cloud and AI tool credentials and carried a second-stage RAT. LiteLLM says three engineers' GitHub accounts were used, apparently via stolen GitHub CLI OAuth tokens, and the artifacts were built from an attacker-controlled repository. It is LiteLLM's second compromise in seven months. Details: LiteLLM 1.107.0 compromised.

OpenCode Console (October 16 to 17)

OpenCode said "a large scale distillation attack" impacted 1.4% of Console users, whose saved provider keys may have been exposed through a legacy system. Anthropic revoked affected keys and OpenAI refunded affected customers. Details: OpenCode Console breach.

OpenRouter (October 20, unconfirmed)

Dark-web trackers listed OpenRouter as a victim; a law firm opened an investigation. OpenRouter had not confirmed anything. See the claim analysis.

Release pipelines: the official download was the malware

OVHcloud CLI (October 19)

An attacker hijacked a contributor's GitHub account and replaced release assets for v0.11.0 through v0.15.0, including the checksums.txt file, so checksum verification would not have caught it. The swapped files were live for about 94 minutes. OVHcloud's founder said the root cause was that GitHub release immutability was disabled; it is now on, and v0.16.0 is a clean, immutable release. Source builds and Docker images were reported clean. Anyone who installed during the window should rotate every secret on that disk, including OVHcloud API credentials.

Rank Math PRO 3.0.123 (October 15 to 16)

Copies of Rank Math PRO 3.0.123 downloaded or auto-updated between October 15, 20:02 UTC and October 16, 07:12 UTC contained a self-restoring backdoor. The fix is 3.0.124 (CVE-2026-111862), but updating does not remove what was planted. Treat activated copies as compromised: restore a pre-incident backup and rotate credentials. Indicators include connections to rank1cdn.com and admin accounts starting with wpsupport_.

SubQuery @subql/common 5.8.3 (October 5)

StepSecurity and GMO Flatt Security found that a modified publish workflow replaced the locally built package with an archive from ci-artifacts.dev just before release, and it was still published through GitHub Actions OIDC trusted publishing. The payload collects .npmrc, .env, AWS, SSH and kubeconfig secrets and GitHub Actions runner memory, and supports a remote shell. It runs at install and at import, so disabling install scripts is not enough. Use 5.8.2.

Tensorlake npm 0.5.144 (October 8)

A rogue commit landed at 01:20 UTC and the release workflow published it the next day. The preinstall payload is a Shai-Hulud variant that steals npm, GitHub, AWS, Vault, Kubernetes, SSH and .env secrets plus AI tool configs, republishes packages the victim can publish, and includes a dead-man's switch that can wipe the machine if its embedded GitHub token is revoked. Remove persistence before rotating credentials. Tensorlake builds sandboxes for AI agents; its PyPI and Cargo packages showed no compromise.

GhostAction (from October 7)

Attackers use stolen personal access tokens to push workflows named like security-audit.yml or github_actions_security.yml that send package, cloud, GitHub and AI service credentials to attacker infrastructure. The 2026 variant also mines Git history. Reported scale ranges from 790 repositories (a public lower bound through October 9) to tens of thousands, across hundreds to about 1,900 accounts. Deleting the workflow does not revoke what was already sent.

Plugins and connection keys

TeamUpdraft (October 17 to 18)

TeamUpdraft believes its customer database was accessed, including connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Attackers then used UpdraftCentral keys to send validly signed commands that installed backdoor plugins; Patchstack counted at least 99 malicious plugin variants. Versions 1.26.13 (free) and 2.26.13 (Premium) revoke the stolen keys. Delete UpdraftCentral keys on each site, check plugin folders and users directly, and rotate storage credentials. Self-hosted UpdraftCentral and backups in your own storage are reported unaffected.

ConnectWise Cloud Backup (October 13 to 17)

Attackers used a compromised credential for ConnectWise Cloud Backup's application identities to obtain tokens with the app's Microsoft 365 permissions. Huntress confirmed unauthorized sign-ins in 162 tenants by October 16; The Hacker News reports 173. ConnectWise disabled seven application identities at 07:00 UTC on October 17 and suspended the service. Existing backup archives remain encrypted and show no sign of compromise. Admins should check every application for credentials added since October 13 and review service principal sign-ins.

Trust infrastructure and runtimes

• eMudhra: eight intermediate CA keys were computable (one was the number 4). Browsers blocked them within hours; Go, Node.js, Python certifi and trust stores needed updates. Full post.
• Tailscale: its October 21 bulletin says hosts trusting the eMudhra intermediates could accept forged TLS; Tailscale v1.104.2 ships Go 1.27.3, which distrusts them. Node-to-node WireGuard traffic was not affected.
• PHP2Shell: two critical PHP interpreter RCEs, found with AI, leaked early and attacked before the patch. How it works, patch guide.
• Node.js: ten CVEs including a Brotli decoder RCE and TLS hostname bypasses. Analysis.
• GitLab: CVE-2026-110264, CVSS 10.0 unauthenticated RCE back to 7.0. Analysis.
• Java: Oracle's October CPU fixed 55 Java SE CVEs. Analysis.

Exploited this week: Plex2Shell, SiteGuard, Siemens

CISA added six actively exploited flaws to its KEV catalog around October 20, and they belong on this list because each one sits on software people install and forget.

• Plex2Shell (Plex Media Server): four chained CVEs (CVE-2026-96652, -96654, -96655, -96656) give unauthenticated remote code execution. Researcher Zach Main reported them in July, Plex fixed them on August 3 in 1.43.3.10861, the chain and a PoC went public on October 16, and exploitation started the next day, dropping an XMRig miner and a Linux proxy backdoor. Patched months earlier, still exploited: the update was the gap.
• SiteGuard Server Edition (CVE-2026-106931): command injection in a web application firewall's statistics feature, on by default, gives root or SYSTEM. JPCERT/CC warned on October 14. Disable statistics as a workaround and preserve evidence before patching.
• Siemens Software Center (CVE-2026-110936): a DLL side-loading flaw that the Romulus ClickFix campaign abuses by bundling a genuine Siemens binary with malicious DLLs, distributed outside Siemens channels. Siemens says none of its systems or update channels were breached; 4.0.9.8 fixes it and installs update on next start.

Our CVE database has the entries: CVE-2026-96656, CVE-2026-106931, CVE-2026-110936.

State Bank of India (October 21)

SBI told stock exchanges that a preliminary review found 3,897 of its customers' records in a set of about 375,000 records on the dark web, after alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency and CERT-In. The exposed fields are names, contact details, dates of birth and loan or lead identifiers; account numbers, balances, passwords, OTPs, card data, PAN and Aadhaar are not listed. A threat actor had claimed 3.75 lakh records and 2,700 documents; SBI has not established the source. The main risk for customers is targeted impersonation calls and messages.

The patterns

1. Stolen tokens, not zero-days. GitHub PATs (GhostAction), GitHub CLI OAuth tokens (LiteLLM), a contributor account (OVHcloud), an application credential (ConnectWise), connection keys (TeamUpdraft) and unrotated admin keys (Zeabur). The exploit was usually a login.
2. Legitimate channels delivered the malware. Trusted publishing (SubQuery), release workflows (Tensorlake), official update servers (Rank Math), signed remote commands (UpdraftCentral) and official release pages (OVHcloud). Verification that checks "did this come from the right place" passed.
3. Checksums and tags are not enough. OVHcloud's attacker replaced checksums.txt; LiteLLM's attacker moved latest. Immutable releases, pinned digests and provenance checks are what would have held.
4. Rotation that misses one credential is not rotation. Zeabur's second breach came from admin tokens left out after the first.
5. AI keys are now a primary target. Railway's attacker wanted AI inference access, OpenCode called its incident a distillation attack, and LiteLLM, Tensorlake and GhostAction all harvest AI tool credentials. See AI-led attacks in October 2026.
6. Cleanup comes before rotation for active malware. Tensorlake's dead-man's switch wipes machines when its token is revoked; kill persistence first.

One checklist for the month

• Rotate every secret stored on Railway or Zeabur, every provider key saved in OpenCode, and every secret on any host that ran LiteLLM 1.107.0, Tensorlake 0.5.144, @subql/common 5.8.3 or OVHcloud CLI v0.11.0 to v0.15.0.
• Pin dependencies to exact versions and container images to digests; stop deploying latest.
• Turn on GitHub release immutability for your own projects.
• Search your GitHub org for security-audit.yml, github_actions_security.yml and unknown workflows, and review PATs and OAuth apps.
• Audit Microsoft 365 apps for credentials added since October 13 if you used ConnectWise Cloud Backup.
• WordPress: check Rank Math PRO and UpdraftPlus sites for unknown plugins and wpsupport_ admins; delete UpdraftCentral keys.
• Patch runtimes: PHP, Node.js, GitLab, Java, and update trust stores and Tailscale.
• Cap AI keys: spend limits and one key per app or agent.
• Watch your coding agents. Many of these stealers read the same files agents read: .env, .npmrc, SSH keys and AI tool configs. Beam records what coding agents read and run on developer machines and asks for approval on .env and credential reads, which helps you find where secret copies live before an attacker does.

Related reading

• AI-led attacks in October 2026
• Railway breach: rotate every secret
• LiteLLM 1.107.0 compromised
• npm supply chain worms and AI tooling
• PHP2Shell and AI agents

Primary sources: The Hacker News: Plex2Shell · heise: Plex, SiteGuard, Siemens · The Hacker News: SBI · Railway · LiteLLM · Zeabur · TeamUpdraft · Tailscale bulletins · StepSecurity: SubQuery · Aikido: Tensorlake · The Hacker News: Rank Math · The Hacker News: ConnectWise · The Hacker News: GhostAction · IT-Connect: OVHcloud CLI

Accurate as of October 22, 2026. Several incidents are still under investigation; numbers and timelines may change.