[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$fah2p9ahuqh80":56,"i-tabler:arrow-left":121,"i-tabler:tag":123},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":66,"html":67,"metaTitle":58,"metaDescription":68,"shareImage":69,"updatedAt":73,"author":74,"related":77},"ovhcloud-cli-releases-were-swapped-for-a-secret-stealing-build-for-94-minutes","OVHcloud CLI Releases Were Swapped for a Secret-Stealing Build for 94 Minutes","Attackers used a hijacked developer account to replace OVHcloud CLI v0.11.0 to v0.15.0 binaries on GitHub with a secret-stealing build on October 19. If you installed or updated in that window, rotate every secret on the machine and move to v0.16.0.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fovhcloud-cli-supply-chain-advisory.png","2026-10-20T20:37:21.000+08:00",[63],{"key":64,"label":65},"security","Security",5,"\u003Cp>Attackers swapped the release binaries of five versions of OVHcloud's official command-line tool, \u003Ccode>ovhcloud\u003C\u002Fcode>, for a build designed to steal secrets from the machine it runs on. The tampered files sat on the project's GitHub release pages for about 94 minutes on October 19 before OVHcloud deleted them. Anyone who installed or updated the CLI on macOS, Linux or Windows from those release pages during that window should treat every secret on that machine as exposed.\u003C\u002Fp>\u003Cp>OVHcloud CEO Octave Klaba \u003Ca href=\"https:\u002F\u002Fx.com\u002Folesovhcom\u002Fstatus\u002F2112225308589834260?ref=ghost.jdneer.com\">announced on X\u003C\u002Fa> that the compromised versions are v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0, that v0.10.0 and the new v0.16.0 are clean, and that the attacker \"used the GitHub account of one of the developers and added a binary whose job is to retrieve secrets from the disk.\" He called the binary's quality poor \"but it can go all the way,\" and told affected users to change all the secrets on their disk. This is a supply-chain compromise, not a software vulnerability, and no CVE has been assigned.\u003C\u002Fp>\u003Ch2 id=\"timeline\">Timeline\u003C\u002Fh2>\u003Cp>OVHcloud's statements use Paris time (UTC+2). The UTC times below come from Klaba's posts, the public \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fovh\u002Fovhcloud-cli\u002Fissues\u002F300?ref=ghost.jdneer.com\">GitHub issue #300\u003C\u002Fa>, and the server-side GitHub records analyzed by \u003Ca href=\"https:\u002F\u002Fopensourcemalware.com\u002Fblog\u002Fglassworm-hacks-ovh-clouds-cli-tool?ref=ghost.jdneer.com\">OpenSourceMalware\u003C\u002Fa>.\u003C\u002Fp>\n\n\u003Ctable>\u003Cthead>\u003Ctr>\u003Cth>UTC (Oct 19)\u003C\u002Fth>\u003Cth>Manila\u003C\u002Fth>\u003Cth>Event\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\n\u003Ctr>\u003Ctd>12:47\u003C\u002Ftd>\u003Ctd>Oct 19, 8:47 PM\u003C\u002Ftd>\u003Ctd>First swapped files land on v0.15.0\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>12:57 to 13:12\u003C\u002Ftd>\u003Ctd>8:57 to 9:12 PM\u003C\u002Ftd>\u003Ctd>Checksums and the other releases swapped\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>13:50\u003C\u002Ftd>\u003Ctd>9:50 PM\u003C\u002Ftd>\u003Ctd>A user files issue #300 after a pinned hash fails in CI\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>14:21\u003C\u002Ftd>\u003Ctd>10:21 PM\u003C\u002Ftd>\u003Ctd>OVHcloud deletes all swapped files\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>16:52\u003C\u002Ftd>\u003Ctd>Oct 20, 12:52 AM\u003C\u002Ftd>\u003Ctd>Klaba posts the alert on X\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>17:16\u003C\u002Ftd>\u003Ctd>Oct 20, 1:16 AM\u003C\u002Ftd>\u003Ctd>Clean, immutable v0.16.0 published\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>20:29\u003C\u002Ftd>\u003Ctd>Oct 20, 4:29 AM\u003C\u002Ftd>\u003Ctd>Klaba declares the incident closed\u003C\u002Ftd>\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\n\n\u003Cp>The issue was caught by a user, not by OVHcloud. Their CI job pinned the SHA-256 of \u003Ccode>ovhcloud-cli_Linux_arm64.tar.gz\u003C\u002Fcode> from v0.15.0 and started failing. In the issue, they showed that the new file was a local, \"dirty\" Go build of a later commit, uploaded by the account \u003Ccode>HassenBF\u003C\u002Fcode> rather than by the release pipeline, and asked whether it was intentional. OVH maintainer Romain Beuque replied that all the binaries involved were deleted at 16:21 Paris time and then shipped \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fovh\u002Fovhcloud-cli\u002Freleases?ref=ghost.jdneer.com\">v0.16.0\u003C\u002Fa>, saying the release is immutable \"so the assets attached to it can be trusted.\" OVHcloud has promised a detailed post-mortem \"in the coming days.\"\u003C\u002Fp>\u003Ch2 id=\"how-it-happened\">How it happened\u003C\u002Fh2>\u003Cp>No source code changed. The attacker replaced files attached to releases that had been published months earlier, using an account that already had write access to the repository. In his \u003Ca href=\"https:\u002F\u002Fx.com\u002Folesovhcom\u002Fstatus\u002F2112280116017471626?ref=ghost.jdneer.com\">follow-up post\u003C\u002Fa>, Klaba said the CI\u002FCD pipelines, including unit tests, functional tests and CVE detection, were not affected. The gap was that GitHub's release immutability option had not been turned on, so a user with the right permissions could modify existing releases directly on GitHub without passing through OVHcloud's CI\u002FCD. OVHcloud has since enabled it.\u003C\u002Fp>\u003Cp>According to OpenSourceMalware, only the mainstream builds were replaced: macOS on Apple silicon and Intel, Linux x86_64 and arm64, Windows x86_64, and each release's \u003Ccode>checksums.txt\u003C\u002Fcode>, so the published hashes matched the swapped files. The Linux and Windows i386 builds, the Windows arm64 build and the WebAssembly build were left alone. The issue reporter confirmed the swaps directly for v0.13.0 to v0.15.0; for v0.11.0 and v0.12.0, the researchers rely on OVHcloud's statement and the files left behind.\u003C\u002Fp>\n\n\u003Ctable>\u003Cthead>\u003Ctr>\u003Cth>Version\u003C\u002Fth>\u003Cth>First published\u003C\u002Fth>\u003Cth>Swapped Oct 19\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\n\u003Ctr>\u003Ctd>v0.10.0\u003C\u002Ftd>\u003Ctd>Mar 2, 2026\u003C\u002Ftd>\u003Ctd>No (clean)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>v0.11.0\u003C\u002Ftd>\u003Ctd>Apr 14, 2026\u003C\u002Ftd>\u003Ctd>Yes, per OVHcloud\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>v0.12.0\u003C\u002Ftd>\u003Ctd>May 29, 2026\u003C\u002Ftd>\u003Ctd>Yes, per OVHcloud\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>v0.13.0\u003C\u002Ftd>\u003Ctd>Aug 25, 2026\u003C\u002Ftd>\u003Ctd>Yes, confirmed in #300\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>v0.14.0\u003C\u002Ftd>\u003Ctd>Aug 31, 2026\u003C\u002Ftd>\u003Ctd>Yes, confirmed in #300\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>v0.15.0\u003C\u002Ftd>\u003Ctd>Sep 16, 2026\u003C\u002Ftd>\u003Ctd>Yes, confirmed in #300\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>v0.16.0\u003C\u002Ftd>\u003Ctd>Oct 19, 2026\u003C\u002Ftd>\u003Ctd>No (clean, immutable)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\n\n\u003Cp>OpenSourceMalware also found that the \u003Ccode>HassenBF\u003C\u002Fcode> account, which belongs to a real OVH contributor, appears to have been compromised since at least March 5, 2026, when four of its personal repositories were force-pushed with a hidden JavaScript loader. That loader fetches its next stage through a Solana wallet memo, and the wallet appears on public GlassWorm indicator lists. The researchers stress that linking the March activity to the October release swap is their inference, based on the shared account.\u003C\u002Fp>\u003Ch2 id=\"what-the-payload-did\">What the payload did\u003C\u002Fh2>\u003Cp>Very little is public. OVHcloud says the binary looks for secrets on disk, and Klaba said the company is still analyzing it. OVHcloud deleted the swapped files before anyone archived them, so OpenSourceMalware says it has not analyzed the payload, and neither OVHcloud nor the researchers have published which paths it reads, where it sends data, or any network indicators. The one known-bad file hash comes from the issue reporter's CI.\u003C\u002Fp>\u003Ch2 id=\"indicators\">Indicators\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>Swapped file:\u003C\u002Fstrong> v0.15.0 \u003Ccode>ovhcloud-cli_Linux_arm64.tar.gz\u003C\u002Fcode>, SHA-256 \u003Ccode>3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb\u003C\u002Fcode> (the original was \u003Ccode>5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0\u003C\u002Fcode>)\u003C\u002Fli>\u003Cli>\u003Cstrong>Build metadata of the swapped binary:\u003C\u002Fstrong> module version \u003Ccode>v0.15.1-0.20261013083505-5ead8ef9b43d+dirty\u003C\u002Fcode>, \u003Ccode>vcs.revision=5ead8ef9b43d354dfb5caadff803b11afc8c5c58\u003C\u002Fcode>, \u003Ccode>vcs.modified=true\u003C\u002Fcode>\u003C\u002Fli>\u003Cli>\u003Cstrong>Uploader:\u003C\u002Fstrong> GitHub account \u003Ccode>HassenBF\u003C\u002Fcode>\u003C\u002Fli>\u003Cli>\u003Cstrong>Related loader, per OpenSourceMalware:\u003C\u002Fstrong> \u003Ccode>preinstall.js\u003C\u002Fcode>, SHA-256 \u003Ccode>43df42fd79f6f81e530892b54634598770d6e496796a863c596e616bcb3fec70\u003C\u002Fcode>; Solana wallet \u003Ccode>BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC\u003C\u002Fcode>; marker file \u003Ccode>~\u002Finit.json\u003C\u002Fcode> on macOS\u003C\u002Fli>\u003C\u002Ful>\u003Ch2 id=\"are-you-affected\">Are you affected?\u003C\u002Fh2>\u003Cp>OpenSourceMalware says you are affected if, between 12:47 and 14:21 UTC on October 19 (8:47 to 10:21 PM Manila), you installed or updated the CLI on macOS, Linux x86_64 or arm64, or Windows x86_64 using the official \u003Ccode>install.sh\u003C\u002Fcode> script, a direct download from the releases page, or a CI job or Dockerfile that fetches from \u003Ccode>github.com\u002Fovh\u002Fovhcloud-cli\u002Freleases\u002Fdownload\u002F\u003C\u002Fcode>. You are not affected if you used \u003Ccode>go install\u003C\u002Fcode>, built from source, used the \u003Ccode>ovhcom\u002Fovhcloud-cli\u003C\u002Fcode> Docker image, or did not install or update during the window.\u003C\u002Fp>\u003Cp>The researchers also list Homebrew as an affected route. However, the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fovh\u002Fhomebrew-tap\u002Fblob\u002Fb70a654\u002FCasks\u002Fovhcloud-cli.rb?ref=ghost.jdneer.com\">Homebrew cask\u003C\u002Fa> that OVHcloud published for v0.15.0 pins the SHA-256 of the original archives, and Homebrew checks downloads against it, so a Homebrew install during the window should have failed with a checksum mismatch rather than installing the swapped file. OVHcloud has not addressed this, so Homebrew users who installed or upgraded during the window should still check.\u003C\u002Fp>\u003Cp>\u003Cstrong>Find the binary and when it was installed.\u003C\u002Fstrong> Look for a timestamp inside the window. On Linux:\u003C\u002Fp>\u003Cpre>\u003Ccode>bin=$(command -v ovhcloud)\nls -lL --time-style=full-iso \"$bin\"\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>On macOS, use \u003Ccode>stat -L -f '%Sm' \"$(command -v ovhcloud)\"\u003C\u002Fcode>.\u003C\u002Fp>\u003Cp>\u003Cstrong>Inspect it without running it.\u003C\u002Fstrong> If Go is installed, read the build info:\u003C\u002Fp>\u003Cpre>\u003Ccode>go version -m \"$(command -v ovhcloud)\" | grep -E 'mod|vcs'\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>A line reading \u003Ccode>vcs.modified=true\u003C\u002Fcode> or a module version ending in \u003Ccode>+dirty\u003C\u002Fcode> marks the swapped build. OpenSourceMalware also notes that \u003Ccode>ovhcloud version\u003C\u002Fcode> prints the tag on clean builds but not on the swapped one; be aware that this command runs the binary.\u003C\u002Fp>\u003Cp>\u003Cstrong>Homebrew users:\u003C\u002Fstrong> check the installed version and when it was installed:\u003C\u002Fp>\u003Cpre>\u003Ccode>brew list --cask --versions ovhcloud-cli\nls -l \"$(brew --caskroom)\u002Fovhcloud-cli\"\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>\u003Cstrong>Check any archive you kept.\u003C\u002Fstrong> Run \u003Ccode>sha256sum\u003C\u002Fcode> on it (\u003Ccode>shasum -a 256\u003C\u002Fcode> on macOS) and compare with the hashes above or with the checksums in the v0.16.0 release.\u003C\u002Fli>\u003Cli>\u003Cstrong>If you ran a swapped binary, rotate everything from a different, clean machine.\u003C\u002Fstrong> OVHcloud's advice is to change all the secrets on your disk. OpenSourceMalware's list includes OVHcloud API application keys and consumer keys (including \u003Ccode>~\u002F.ovh.conf\u003C\u002Fcode>), other cloud provider credentials, SSH keys, \u003Ccode>.npmrc\u003C\u002Fcode>, \u003Ccode>.pypirc\u003C\u002Fcode> and \u003Ccode>.netrc\u003C\u002Fcode> tokens, Kubernetes configs and anything in \u003Ccode>.env\u003C\u002Fcode> files. Revoke the old OVHcloud API credentials rather than only issuing new ones, and include CI runners that fetched the CLI during the window.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>\u003Cstrong>Remove the binary and install v0.16.0 or later.\u003C\u002Fstrong>\u003C\u002Fp>\u003Cpre>\u003Ccode>brew update && brew upgrade --cask ovh\u002Ftap\u002Fovhcloud-cli\n# or, without Homebrew:\nu=https:\u002F\u002Fraw.githubusercontent.com\u002Fovh\u002Fovhcloud-cli\ncurl -fsSL \"$u\u002Fmain\u002Finstall.sh\" | sh\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>The v0.16.0 release ships a GitHub release attestation. With the GitHub CLI, you can check a downloaded archive using \u003Ccode>gh attestation verify ovhcloud-cli_Linux_x86_64.tar.gz --repo ovh\u002Fovhcloud-cli\u003C\u002Fcode>.\u003C\u002Fp>\u003Cp>The issue reporter's habit is the broader lesson: pinning and checking the hash of every third-party binary in CI is what flagged the swap about an hour after it began, and the files were deleted 94 minutes after the first one went up. Projects that publish binaries on GitHub can close the same gap by turning on immutable releases, as OVHcloud has now done.\u003C\u002Fp>","Attackers used a hijacked developer account to replace OVHcloud CLI v0.11.0 to v0.15.0 binaries on GitHub with a secret-stealing build on October 19. If...",{"src":60,"width":70,"height":71,"type":72},1600,900,"image\u002Fpng","2026-10-20T20:46:04.000+08:00",{"name":75,"url":76,"owner":13},"Aiko Tanaka",null,[78,90,101,112],{"slug":79,"title":80,"excerpt":81,"image":82,"publishedAt":83,"topics":84,"readMinutes":89},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[85,88],{"key":86,"label":87},"advisories","Advisories",{"key":64,"label":65},1,{"slug":91,"title":92,"excerpt":93,"image":94,"publishedAt":95,"topics":96,"readMinutes":89},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[97,100],{"key":98,"label":99},"guides","Guides",{"key":64,"label":65},{"slug":102,"title":103,"excerpt":104,"image":105,"publishedAt":106,"topics":107,"readMinutes":89},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[108,111],{"key":109,"label":110},"opinion","Opinion",{"key":64,"label":65},{"slug":113,"title":114,"excerpt":115,"image":116,"publishedAt":117,"topics":118,"readMinutes":89},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[119,120],{"key":109,"label":110},{"key":64,"label":65},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":122},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":124},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]