criticalclosedpatched
OVHcloud CLI releases backdoored on GitHub
› OVHcloud CLI (GitHub releases)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Oct 19, 2026
- closed
- Oct 20, 2026
- CVEs
- none
- sources
- 1
## summary
In mid-October 2026 OVHcloud said attackers hijacked a developer GitHub account and planted an information stealer in five releases of its open-source CLI. Users who installed those releases should treat workstations as compromised and rotate credentials.
severity: Critical supply-chain
## affected
- Five backdoored releases during the Oct 2026 window (see OVHcloud advisory)
## fixed in
- Clean releases after incident; reinstall from verified source
## news & write-ups[1]
## notes & caveats
Primary OVHcloud advisory URL should be confirmed from OVHcloud security notices; secondary aggregator used for date/context.
