It’s almost Halloween, and October has already done the scary part for us. Every few days this month a new headline landed in my feed, each one louder than the last. Some were real. Some were real but badly framed. A couple made people panic for the wrong reasons.
So I’m starting something new: a short recap at the end of every month. What actually happened, what it means for a normal business, which headlines got it wrong, and what to do on Monday morning. No fear-mongering, no mocking anyone who got hit. Every fact below links to its source.
If October had one pattern, it was this: most attackers didn’t break in, they logged in. Stolen tokens, forgotten admin keys and trusted update channels did most of the damage.
State Bank of India: records found, source unknown
In a stock exchange filing dated 21 October, SBI said it had identified 3,897 customer records with personal information inside a set of about 375,000 records available on the dark web. The filing lists names, registered mobile numbers, dates of birth, addresses, branch and CIF identifiers and loan or lead metadata. It does not list account numbers, passwords, OTPs, card details, PAN or Aadhaar. The bank says it does not yet know where the data came from, and it has brought in an independent auditor from CERT-In’s panel.
The one fix for you: if you bank with SBI, be extra careful with calls or messages that know your name, branch and date of birth. That’s exactly what this kind of data makes possible.
Zeabur: the credential nobody rotated
Zeabur, a hosting platform for developers, was breached for the second time in two months on 14 and 15 October. Its preliminary report says long-lived admin credentials sat in plaintext in a private config repo and “were omitted from rotation following the August incident”. Reported exposure: 321,810 accounts and more than 3.2 million environment variable records. The company announced it will shut down its services by 31 December 2026.
The one fix: if you ever deployed on Zeabur, rotate every secret you stored there. All of them, not just the ones you remember.
LiteLLM 1.107.0: 1 hour 43 minutes was enough
On 21 October, all seven PyPI wheels of litellm==1.107.0 were live from 11:39 to 13:23 UTC, along with affected Docker images. The payload stole browser, cloud and AI tool credentials, and it ran from Python’s startup hooks, so any Python process in that environment ran it. LiteLLM says the attackers used three engineers’ GitHub accounts, apparently through stolen GitHub CLI tokens.
The one fix: pin a known good version (the tracker suggests 1.106.2), rebuild any image that pulled latest that day, and rotate every secret on those hosts.
42 GitHub repositories and files too big to search
JFrog reported 42 compromised repositories where attackers hid payloads in files up to 13.7 MB, large enough “to evade the GitHub search and API paths normally used to find this kind of compromise”. The repos carried execution hooks for AI coding assistants and IDEs, in files like .claude/settings.json, .cursor/mcp.json and .vscode/tasks.json.
The one fix: look at those config folders in your repos with your own eyes. Don’t trust code search to find them.
Rank Math PRO 3.0.123: the official update was the problem
Copies of this WordPress SEO plugin downloaded or auto-updated between 15 October 20:02 UTC and 16 October 07:12 UTC contained a self-restoring backdoor. Version 3.0.124 fixes the plugin, but updating does not remove what was already planted.
The one fix: if your site got that version, treat it as compromised. Look for admin users starting with wpsupport_, restore a backup from before 15 October, and rotate passwords.
What the headlines got wrong
What was said: “70% of websites are hacked.”
What it means: PHP runs some 70% of the world’s websites, and Wiz Research, using OpenAI technology, found serious flaws in PHP itself. That puts a lot of sites at risk. It doesn’t mean they were hacked. The risk was real though: Cloudflare saw exploit attempts climb into the millions, and some government services in the UK, Finland and France went offline as a precaution.
What to do: the PHP project says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both critical bugs. Run php -v, or ask your hosting provider which version you’re on. Then update WordPress and your plugins too.
What was said: “SBI was hacked.”
What it means: records were found for sale. The bank confirmed 3,897 of them contain customer personal information and said the source is still unknown. It could be the bank, a subsidiary, or a vendor that handles applications. Nobody knows yet.
What to do: ask yourself where every copy of your customer data lives. Your CRM, the loan agent’s laptop, that CSV export someone emailed to a vendor in 2023. Leaks often come from the copy you forgot.
What was said: “Ransomware hit a record.”
What it means: Comparitech counted 2,627 claimed attacks in Q3 2026, the highest quarter it has recorded. Of those, 247 were confirmed by the organisation involved. India’s count rose from 37 to 80. It’s a count of victims gangs publicly claimed. It’s a useful trend line, but it doesn’t tell you your own risk.
What to do: the boring stuff still works. Backups you’ve actually restored from, patching, and MFA on everything.
The pattern, and five habits that close most of it
Look at the list again. Zeabur: an admin key nobody rotated. LiteLLM: stolen GitHub tokens. Rank Math: a trusted update channel. The GitHub repos: config files nobody reads. Almost nothing here needed a genius exploit. Here’s what I’d do this week:
- Keep a list of every secret, including the admin ones in config repos. Rotation that skips one key isn’t rotation.
- Pin your dependencies to exact versions or digests. Don’t let
latestdeploy itself on a Tuesday. - Turn off silent auto-updates for anything with admin rights, or at least get an alert when they happen.
- Test a restore, not just a backup. I wrote about why most backups fail the one test that matters.
- Map where your customer data lives, including copies with vendors.
What this means under DPDP
If you handle personal data of people in India, this part is for you. Under the DPDP Rules, a data fiduciary has to send the Data Protection Board a detailed breach report within 72 hours: what happened, how much, when, where and the likely impact. The main duties, including reasonable security safeguards, apply from 13 May 2027. That’s about six and a half months from today.
The penalty for failing to take reasonable security safeguards can go up to Rs 250 crore. Read the incidents above with that in mind. “We didn’t know that copy existed” or “we forgot to rotate that key” is exactly the gap a 72 hour report will expose.
This isn’t legal advice. It’s a nudge to start your readiness work now, while six months still feels like a lot.
Before you go
If you want a quick sense of where you stand, there’s a free DPDP readiness check. And if any of October’s incidents touched your stack and you’d like a second pair of eyes, just reach out or write to contact@broadifitech.com.
A new recap goes up at the end of every month. Happy Halloween, and go rotate that one key you’ve been meaning to.
