# OVHcloud warns compromised CLI releases could steal developer secrets

_Published Tuesday, October 20, 2026 at 8:08 AM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

![OVHcloud warns compromised CLI releases could steal developer secrets — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/20/ovhcloud.jpg)

OVHcloud warned that attackers used a hijacked developer GitHub account to replace command-line tool releases with malware designed to retrieve secrets from disk. Versions 0.11.0 through 0.15.0 were compromised; version 0.10.0 and the latest release, 0.16.0, are clean, CEO Octave Klaba said.

The malicious release appeared October 19 and was blocked after a customer report. GitHub's release immutability setting was disabled, allowing existing releases to be changed without passing automated checks. OVHcloud has enabled that protection and urges affected users to clean their systems and revoke all secrets. Source builds and Docker images were unaffected.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/)

---
Canonical: https://techandbusiness.org/newswire/i-d_7nRVuRvzi83DZciHJE
Published: 2026-10-20T12:08:13.471Z
Story chronology: 2026-10-19T00:00:00.000Z
Retrieved: 2026-10-20T15:24:15.665Z
Publisher: Tech & Business (techandbusiness.org)