October's Security Roundup: 15 Breaches and Backdoors

October was Cybersecurity Awareness Month, and the irony was hard to miss. The month's incident list runs from Railway to Tailscale, and it does not get quieter as it goes. Here is everything on it, in one place.

Customer secrets, backdoored binaries, infected packages and a compromised certificate authority all landed in the same few weeks. If you run any of these tools, this is the short version of what to check.

What Happened

• Railway — customer secrets exposure.
• LiteLLM — malicious PyPI and Docker releases.
• Zeabur — infrastructure breached.
• OpenCode — AI API keys exposed.
• OVHcloud CLI — official binaries backdoored.
• Rank Math PRO — malware in the official plugin.
• TeamUpdraft — customer data compromised.
• ConnectWise — cloud backup identities compromised.
• Tensorlake — npm package infected.
• SubQuery — backdoored npm package.
• GhostAction — GitHub repos with malicious workflows.
• PHP — PHP2SHELL critical RCE vulnerabilities.
• Node.js — security vulnerabilities patched.
• eMudhra — certificate authority keys compromised.
• Tailscale — eMudhra incident.

The list closes with GitLab, with no further detail attached.

Why It Matters

Read the list again and the shape of it is the point. LiteLLM, Tensorlake, SubQuery and GhostAction all came through package registries and repositories — PyPI, npm, Docker, GitHub workflows. Rank Math PRO and the OVHcloud CLI went further and put the problem inside the official download itself, which is the one channel most people never think to doubt.

Not every line is a breach. Node.js is a patch, and Tailscale is downstream of the eMudhra certificate authority exposure rather than a break of its own. But a compromised CA is the kind of thing that reaches every site you trust with a padlock, so it belongs on the same page as the rest.

The practical takeaway is narrow and dull: pin your package versions, check release signatures where a project offers them, and rotate any key that sat in a service on this list. Nothing here is exotic, and that is what makes it worth a second look.