October 2026: Cascading Infrastructure Security Breaches
October is shaping up as a catastrophic month for software supply chain security, with Railway, LiteLLM, Node.js, GitLab, OVHcloud CLI, and others all compromised. The Railway breach specifically drained ~$371k in crypto keys from user environments.
What we know
Beyond PHP, the broader October breach wave is alarming multiple communities. An account on X relayed that Railway's incident drained crypto private keys from ~200 distinct addresses across 19+ EVM chains, totaling ~$371k, via attacker `0xd9773325282874d18cb83f1fe50f14c39750b2ee`. Another account on X noted the recommended mitigation is essentially to brick any Railway-dependent app features. Another account on X aggregated the full list — Railway, LiteLLM, Zeabur, OpenCode, OVHcloud CLI, Rank Math PRO — calling it 'only a beginning.' another account on X RT'd a comprehensive Oct 17–21 breach timeline. Emollick commentary (RT'd by Noahpinion) framed it as AI accelerating attack/defense at inhuman speeds interacting with slow human response systems.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.