October 2026 in review: the 10 security events that mattered

October was the month the LLM security conversation stopped being theoretical. A supply-chain poisoning reached production AI infrastructure, an open-weight tool crossed from research into real attack activity, a $6.3B theft completed in twenty minutes, and a one-click refusal-removal tool hit 9,000 stars while regulators started asking questions. This review ranks the ten events that mattered, with the lesson each one proved and links to our full coverage of each.

How we ranked: every candidate was scored on impact (×3), exploitability (×2), fix status (×2), novelty (×1.5), and actionability (×1.5), with one-vote vetoes for pure FUD, unconfirmable claims, and out-of-scope stories. Events were then deduplicated by lesson type — ten supply-chain stories are one story told four times. The method is published so you can argue with the ranking instead of trusting it.

The month at a glance

1. Binance: $6.3B in twenty minutes

The largest theft in crypto history completed in roughly twenty minutes on October 29 (WIRED reconstruction). Binance's initial attribution to a single compromised laptop was officially revised to "additional points of breach" — and that revision is itself the first lesson: single-point narratives about complex intrusions harden before corrections arrive. The deeper economics: on an irreversible ledger, detection-then-response assumes a rollback window that does not exist, so the entire defense budget moves upstream , approval chains, submission-time anomaly controls, pre-authorized kill-switches. Red-team translation: map the blast path from one compromised endpoint by testing it, not diagramming it, and measure time-to-block against the attacker's execution window. Full analysis: the Binance breach security lessons.

2. LiteLLM 1.107.0: the supply chain reaches AI infrastructure

Wiz researchers found a backdoor in a released LiteLLM version — poisoned upstream code, in the dependency path of production AI stacks. The reason this ranks second and not fifth: it demonstrated that AI infrastructure inherits the software supply chain's worst property (you ship what your dependencies ship) without inheriting its mature defenses (SBOM discipline, pinning culture, reproducible builds). Teams running AI stacks with dozens of transitive dependencies got a live-fire exercise in dependency triage. Our full reconstruction covers the timeline and the trust-transitivity problem: LiteLLM 1.107.0 backdoor analysis.

3. PHP2Shell: the exploit curve outran the embargo

The WatchTowr-disclosed core-php RCE became this site's highest-traffic content cluster for a reason: the gap between disclosure and in-the-wild exploitation collapsed to days, and our exploitation-curve analysis documented what that means for patch SLAs. The transferable finding: embargo periods now function as exploit-development windows, and organizations that patch on monthly cycles are structurally timing their updates to arrive after the scans start. Core coverage: PHP2Shell core-php RCE.

4. llama.cpp CVE-2026-116096: your model directory is attack surface

An out-of-bounds write in the Pocket-TTS component, triggered by a malicious mmproj file, with a public exploit (NVD entry, community PSA). The technical details mattered less than the argument they ignited: the top comment called local access a "nothing burger," a sharper reply noted that llama.cpp's threat model is precisely "execute files from the internet" — and that auxiliary files like mmproj get a fraction of the scrutiny GGUF weights receive. Both were right about different layers. Our full analysis includes the verification checklist; the general law is that artifact types get audited in proportion to their fame, not their privilege.

5. n0n ransomware: AI enters real attack activity

The event that changed the threat model's assumptions rather than its numbers: ransomware operators observed using abliterated open-weight models inside an active campaign. Analysis in our coverage flagged what matters operationally — the models did little that a skilled operator could not; their contribution was lowering the language and logistics barrier for the rest of the crew. For defenders, the indicator set now includes AI-usage artifacts (local model directories on compromised hosts, inference-server logs in unusual network positions). The offense-symmetry assumption , that AI attack use stays in research , did not survive October.

6. The Hugging Face takedown wave: availability breaks first

Over a week, several abliterated listings (MiMo-UNCENSORED, huihui Kimi GGUFs, penclaw-GLM) vanished — for business, self-deletion, and cost reasons per the community fact-check, not one coordinated ban. The 1,100-upvote thread and the "Backup your quants" movement that followed proved the demand side: teams built mid-engagement on community checkpoints learned that listing persistence is not a durability guarantee. Our supply-side breakdown includes the ledger discipline that turns this from fire drill to afternoon.

7. OBLITERATUS: refusal removal becomes a dropdown

elder-plinius's toolkit (9k+ stars) wrapped the Arditi-lineage abliteration research — four direction-extraction methods, hosted on free compute, telemetry-fed. Our review treats it as industrialization: the technique is now universal access, which moves the differentiator to verification discipline and sharpens the supply-chain argument, because one-click production floods the ecosystem with unprovenanced checkpoints. The method menu (PCA vs SAE vs whitened SVD, zeroing vs steering) also means "is it abliterated?" now requires a follow-up: ask which method, and record it in run metadata.

8. LangChain MCP CVEs: agents get a defined attack surface

The 2026 LangChain MCP CVE series (our testing write-up) formalized what agent-security teams had been arguing about: tool-invocation paths, tool-description injection, and cross-server trust in MCP topologies are attack surface, with CVEs to track. October's multi-agent harness analysis (attack surfaces primer) extended it: the harness — system prompt, tools, memory, subagents , is now a perimeter, and most teams have never drawn its diagram.

9. The demand poll: the market votes on model craft

A major hosted provider polled users on which non-abliterated models to add at good prices (monitoring capture, provider unnamed by policy). Read with the week's other signals — Moonshot shipping deliberately reduced Kimi weights, listings vanishing , the poll is demand-side evidence that abliteration carries a perceived capability tax and that the market is segmenting: abliterated checkpoints for baselines and diffing, uncensored fine-tunes for production backends, base models for capability-critical steps. That portfolio logic, not single-artifact loyalty, is the selection framework going forward.

10. Anthropic's scanner vs Bitcoin Core: the boundary dispute

When an AI-driven security scanner's findings collided with Bitcoin Core maintainer norms, the community's rejection of the reports (our analysis) drew the clearest line yet around automated vulnerability discovery: volume without context is noise, and "AI found it" is not a validity argument. We ranked this last because its impact is narrowest — but its lesson may age best, as every security team deploying AI triage inherits a version of the same dispute internally.

The October pattern

One trend connects all ten: the artifacts around models — dependencies, weights, projector files, agent tool definitions , became the attack surface, while the models themselves became both cheaper to attack with (n0n) and cheaper to modify (OBLITERATUS). Teams that spent October verifying artifacts (hashes, manifests, provenance) absorbed every event above as routine. Teams that did not spent it firefighting. November's preview is already visible: Qwen4 lands within days (release playbook), and the same sequence will run again with a fresh base.

All coverage above operated within authorized-use boundaries; the incidents are studied here as engineering lessons, not playbooks.