BlackOctober

In October 2026 the code mostly held. Everything around it gave way: a scripting language, a release page, an engineer’s laptop, a domain registrar. This is the record of the month the trust layer broke.

$6.36B taken from Binance in about 20 minutes

What happened

Nobody broke the smart contract. They broke the address you typed to reach it.

Security people started calling it Black October before the month was over. Within a few weeks, AI-assisted researchers found remote-code-execution bugs in PHP itself, a cloud provider’s official command-line tool shipped a credential stealer from its own GitHub releases, the world’s largest exchange lost more than six billion dollars, and on Halloween a dozen crypto sites began serving a wallet drainer from their real domains.

None of it needed a clever exploit against a blockchain. Each attack went through something people had been told to trust without checking: the runtime, the download, the developer, the DNS record.

The month, in order

  1. First shots at PHP

    Amazon logs an exploitation attempt against the PHP flaws days before any patch exists. Defenders are later told to assume secrets on exposed PHP servers leaked from this date.

  2. OVHcloud’s CLI turns on its users

    For 94 minutes, five published releases of the official OVHcloud CLI are swapped for a build that steals secrets from the machine it runs on.

  3. PHP2Shell goes public

    PHP ships emergency fixes for two unauthenticated remote-code-execution bugs. A vendor publishes patched images hours before the coordinated release, handing attackers a map to the fix.

  4. Chained to root

    An attacker pairs PHP2Shell with a Linux kernel flaw and roots 25 servers across the US, Japan, Taiwan and South Korea, including systems on a US government-affiliated network.

  5. Polymarket’s front end bleeds

    Malicious JavaScript slips into the prediction market’s site through a compromised monitoring provider and drains about $2.7M from 737 wallets.

  6. Binance: $6.36 billion, ten chains, twenty minutes

    The largest crypto theft on record, roughly four times the Bybit hack of 2025. Trading halts. Investigators point to North Korea’s TraderTraitor unit.

  7. Halloween: twelve domains go dark

    Flap, Kintsu, StonkFun, Pickle Finance and eight more start serving the Step Drainer from their own addresses after their DNS is hijacked at the registrar.

Case files

PHP2Shell

~70%

of the web runs on PHP, the language with two critical bugs going back a decade

What broke

Two memory-safety flaws in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2, let an unauthenticated attacker run code on the server. Researchers at Wiz say every PHP release of the last ten years is hit by at least one of them, all the way back to 5.4. All three teams that reported them said AI models helped find them.

Why it stung

This was not a poisoned package or a hijacked maintainer. A correctly signed, fully attested PHP binary was the vulnerable thing, so the supply-chain tooling built after SolarWinds had nothing to flag. The PHP project accused Chainguard of breaking the embargo by publishing fixed images more than six hours early.

What came next

Cloudflare saw exploit traffic in the wild, the NSA and FBI urged immediate patching, and CISA added both CVEs to its exploited list. Within days the bugs were chained with the Fragnesia kernel flaw to plant root web shells.

OVHcloud CLI

94 min

that a trusted download page served a credential stealer

What broke

On 19 October, someone using a real OVHcloud contributor’s GitHub account replaced the release binaries for versions v0.11.0 to v0.15.0 with a build that harvests local secrets. A customer spotted it, not OVHcloud.

How they got in

The account had been compromised for around seven months. OVHcloud traces it to a malicious extension on the developer’s personal MacBook; the uploads used stolen keys, and the company’s build systems were untouched. The attacker’s wallet matches indicators from the GlassWorm campaign.

The lesson

StepSecurity counted roughly 250 downloads before the files were pulled. OVHcloud shipped a clean, immutable, attested v0.16.0. Anyone who installed in the window was told to treat every secret on that machine as stolen.

Binance

$6.36B

moved out across Ethereum, Bitcoin, Tron, XRP, Solana and five more chains

What broke

At 20:05 UTC on 29 October, funds began leaving Binance hot wallets. Most of it was gone in about twenty minutes. Binance says its first findings lead back to one engineer’s compromised laptop, which gave the attacker a way to authorise withdrawals.

Who did it

TRM Labs and Chainalysis both attribute the theft to TraderTraitor, the North Korean unit behind the $1.5B Bybit hack. Binance halted trading, Bitcoin dropped about 5%, and Tether and Circle froze hundreds of millions in linked coins.

Where it stands

Around $3B has been frozen with help from other exchanges. Binance has promised to cover every loss and says user funds are safe, but nothing in current rules forces it to, and critics ask what happens when a smaller exchange is next.

The Halloween hijack

12

sites serving one drainer kit from their real addresses

What broke

On 31 October, Blockaid flagged Flap and Kintsu, then ten more sites, all serving the Step Drainer. Their contracts were never touched. The attacker changed the DNS records, so typing the correct address took you to a page built to trick you into signing away your tokens.

The common thread

Not a chain, not a codebase: the registrar. The Block found every affected domain was registered with Name.com, and Kintsu said its domain, bought through Vercel Domains, was hijacked at the registrar level. About $138,000 has been traced so far.

StonkFun’s night

StonkFun confirmed its site was hit, took it offline, and moved it to new infrastructure. It said everything on-chain worked normally, that it knew of no affected users, and asked people to wait an hour for DNS to settle before connecting a wallet.

Twelve doors, one drainer

As flagged by Blockaid on 31 October. Several projects have since restored their sites or moved domains (Flap now runs at flap.cool). Check each project’s official account before connecting a wallet, and revoke any approvals you signed that day at revoke.cash.

What it taught everyone

The chain is only the last link. October showed how many links come before it.

The address bar lies

A correct URL proved nothing on Halloween. If the registrar falls, the real domain becomes the phishing site. Bookmarks and typing carefully can’t save you.

Signed is not safe

PHP2Shell shipped in a perfectly attested binary. Provenance tells you who built something, not whether it’s safe to run.

One laptop is enough

Binance and OVHcloud both trace back to a single person’s machine. A browser extension on a personal Mac became a cloud provider’s problem.

AI cuts both ways

Models found the PHP bugs, and an attacker then automated the PHP2Shell chain to root servers in batches. The gap between disclosure and exploitation is now hours.

From the timeline

What the people at the centre posted as it happened.

Curate posts

Paste X or Twitter post links, one per line. Preview adds them to the feed below. When you’re happy, copy the list and paste it over TWEETS in this file.