Short answer
OVHcloud says an attacker used a developer's GitHub account on 19 October 2026 to swap the download files on existing releases of its command-line tool for a version built to steal secrets. A customer's CI job spotted the checksum mismatch, and OVHcloud deleted the files within hours.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | OVHcloud |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Confirmed by the organization |
| Sector | Cloud hosting |
| Country | France |
| Detected | 2026-10-19 |
| Disclosed | 2026-10-19 |
| People or records affected | Anyone who downloaded and ran OVHcloud CLI releases v0.11.0 to v0.15.0 from GitHub during a window of up to about two hours on 19 October 2026 |
What data was exposed
- Secrets stored on a machine that ran the tampered binary, such as passwords, API keys, SSH keys and environment variable credentials
- OVHcloud says its CI/CD pipelines were not affected
What happened
OVHcloud, the French cloud and hosting company, says its public command-line tool was tampered with on Monday 19 October 2026. According to a GitHub issue opened by a customer, release archives for existing versions were replaced shortly after 12:47 UTC by an uploader account that was not a visible member of the OVH organization. The Hacker News reports an attacker had hijacked a contributor’s GitHub account.
The replacement files were built to steal secrets from any machine that ran them, according to The Hacker News and Next.
How it was found
A customer’s CI pipeline pinned the SHA-256 hash of the Linux arm64 archive and began failing. They opened a public issue noting that the new binary was built from a different commit than the tagged release, with uncommitted changes. OVHcloud staff acknowledged the report and deleted the affected binaries. The Hacker News puts the exposure at up to 94 minutes. Next gives a window of just under two hours.
What OVHcloud did
OVHcloud released v0.16.0 the same day and described it as immutable. A security advisory followed on 20 October, and private vulnerability reporting was enabled on the repository. Next reports that Octave Klaba said the root cause was that GitHub’s immutable releases option was not enabled. He apologized, said the option is now on, and said CI/CD pipelines were not affected. The Hacker News adds that OVHcloud promised a detailed postmortem and had not said how the account was taken over or what the malware collects.
Who is at risk
Only people who downloaded and ran the tampered binaries during the window are exposed. The Hacker News says Homebrew installs, builds from source with go install, and the Docker image were not affected.
What to do
Klaba advised anyone affected to change every secret on the disk. That includes OVHcloud API keys, SSH keys and credentials in environment variables or files. Upgrade to v0.16.0 and review account logs for activity you do not recognize.
Fake “patched download” emails are a common follow-up to incidents like this. See our data breach checklist and our guide to phishing messages. Related: the Cursor marketplace extension incident.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake security notices that claim to be from OVHcloud or GitHub and link to a 'patched' download.
- Abuse of stolen cloud API keys to run servers or send spam, followed by billing disputes.
- Credential-based logins to servers and code accounts using stolen SSH keys or tokens.
What to do if you are affected
- 01If you downloaded and ran a precompiled OVHcloud CLI binary from v0.11.0 to v0.15.0 on 19 October 2026, treat that machine as exposed.
- 02Revoke and renew every secret on that machine: OVHcloud API credentials, SSH keys and any tokens in environment variables or files.
- 03Upgrade to v0.16.0, which OVHcloud published as an immutable release.
- 04Verify release checksums in your own pipelines, as the customer who found this did.
- 05Review OVHcloud account logs for actions you did not take.
Frequently asked questions
Which versions were affected?
The Hacker News and Next both list v0.11.0 to v0.15.0. The GitHub issue itself documents replaced files for v0.13.0, v0.14.0 and v0.15.0. The clean replacement is v0.16.0.
How was the problem found?
A customer whose CI pipeline pinned the SHA-256 of the Linux arm64 archive saw it fail and opened a public GitHub issue on 19 October.
Who is behind it?
No one has been confirmed. The Hacker News reports that researchers at OpenSourceMalware tie the account to the GlassWorm campaign, and describes that as their inference rather than established fact.
Did OVHcloud explain the cause?
Next reports that OVHcloud's CEO, Octave Klaba, said GitHub's immutable releases option was not enabled, which let someone with the right permissions edit existing releases. He said it has since been enabled, and that CI/CD pipelines were not affected.
Sources
- Issue #300: release assets replaced, GitHub (ovh/ovhcloud-cli), 2026-10-19
- Le client en ligne de commande d'OVHcloud compromis par un pirate sur GitHub, Next, 2026-10-20
- Hackers hijack five OVHcloud CLI releases, The Hacker News, 2026-10-20
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.