# Attackers replaced five OVHcloud CLI releases with secret-stealing builds

_Published Tuesday, October 20, 2026 at 7:07 AM EDT · Security, Infrastructure · Latest · Tier 1 — Major_

![Attackers replaced five OVHcloud CLI releases with secret-stealing builds — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSRX5Jjz6vqh8EcVVYoXU8S9qh0rFzQ3DDnjNIlkRrBq97brmk6hUw0u2pbLqyTAG1_mYfG9bGHCnMkgSMEPFu6fIR67F1jZMmS7G7-DFe6i7PtG_LzdTgHLCTXSwE5hCa2EApQeAIYGIMYATwbLEp-2FcPmV9aAHVqrRRBYk_wY7ZTuES0frFAPGjhnU/s1700-nu-rw-lo-l85-e365/ovhcloud.jpg)

An attacker used a hijacked contributor account to replace download archives on five OVHcloud command-line tool releases on October 19, the cloud provider says. The malicious files were available from 12:47 to 14:21 UTC and targeted secrets stored on machines running them.

Exposure covered affected macOS, Linux and Windows downloads through installation paths without pinned hash checks. Homebrew's pinned hashes blocked the substituted files; source builds and Docker images were unaffected. OVHcloud removed the archives and released a clean, immutable v0.16.0. Affected users were advised to rotate every readable secret from another machine: installing a clean version cannot revoke credentials already copied. No swapped archive has been publicly analyzed.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html)

---
Canonical: https://techandbusiness.org/newswire/yedPKR8TgiPJ691HeMLod1
Published: 2026-10-20T11:07:50.674Z
Story chronology: 2026-10-19T12:47:00.000Z
Retrieved: 2026-10-20T15:23:27.517Z
Publisher: Tech & Business (techandbusiness.org)