OVHcloud has confirmed that an attacker used one of its developers' GitHub accounts to replace official command line interface release binaries with a build that pulls secrets off the disk. The tampering happened on 19 October 2026 and was live for roughly 94 minutes.

What happened

Versions 0.11.0 through 0.15.0 of the OVHcloud CLI were affected; 0.10.0 and the newly released 0.16.0 are clean. The attacker wrote over files in already published GitHub releases, which was possible because release immutability was not enabled on the repository, so the change bypassed the CI/CD pipeline entirely. OVHcloud has since turned that setting on.

Researchers at OpenSourceMalware linked the developer account to a compromise dating back to at least March 2026, where repositories were rewritten to carry a hidden loader whose next stage queried the Solana blockchain for a payload location, a known GlassWorm technique. Whether the same actor ran both stages is described as an inference, not a confirmed link.

Who is affected

Anyone who installed or updated the CLI inside the window on macOS, 64-bit Linux or Windows x86_64.

• Installations done with the official install script, Homebrew, or a direct GitHub release download during the window
• Builds from source, go install and the official Docker image are not affected
• The highest-value targets are developer and operations workstations holding cloud keys, SSH keys and CI tokens

What to do now

If anyone on the team installed or updated the OVHcloud CLI on 19 October, treat that machine as compromised and rotate every credential it could reach.

• Check install and update times against 19 October 2026, roughly 12:47 to 14:21 UTC
• Reinstall from 0.16.0 or 0.10.0 rather than trusting an existing binary
• Rotate OVHcloud API keys, SSH keys, cloud tokens and any secrets stored on the affected workstation
• Review OVHcloud and other cloud audit logs for API calls made with those keys after 19 October
• Enable release immutability on your own GitHub repositories so a stolen account cannot rewrite published artefacts

What this means for South African businesses

Plenty of South African SMEs and their web developers run sites and VPS instances on OVHcloud, and the CLI is the kind of tool an admin installs once and forgets. The exposure is not the hosting itself but the credentials sitting on the laptop of whoever runs it. A 94-minute window is easy to miss, and it usually is, so rotation is the only assumption that holds.

Source: SecurityWeek, hijacked developer account used to plant stealer in OVHcloud CLI.

Also on the blog

• Chrome 156 fixes 353 flaws, six of them critical
• Windows Secure Boot 2011 certificates expired on 19 October

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.