OVHcloud CLI Release Hijack: Verify Downloads, Lock Releases
Originally published at WowHow If you installed or updated the OVHcloud CLI (ovhcloud) between 12:47 and 14:21 UTC on 19 October 2026 and ended up on v0.11.0 through v0.15.0, treat every secret readable from that machine as stolen. An attacker used a hijacked developer account to replace the release archives, and OVHcloud's own advisory says the build was meant to harvest secrets from disk [1] . The fix for maintainers is one checkbox: GitHub immutable releases lock a published release's assets and tag [7] . Below: who is affected, what to do tonight, why mutable release assets made this possible, a table of defences, how to switch immutability on, and how to verify a CLI before you run it. TL;DR Affected: ovhcloud-cli v0.11.0 to v0.15.0 downloaded 12:47 to 14:21 UTC on 19 Oct 2026 (macOS, Linux, Windows x86_64 archives). v0.10.0 and v0.16.0 are listed as clean [1] . Do not run the binary to check it. Hash it and compare against the five MD5 values in OVHcloud's ad...