OVHcloud CLI

Mentions · 7d7
Mentions · 30d7
All mentions7
First seenOct 20, 2026
Last mentioned3d ago

Timeline

7 articles · newest first

October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks

Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.

Cyber Security Newsupdated 17:19 UTC · 3h agofirst Oct 22, 07:16 UTC · 3d agoExploit / PoCExploited19 sourcesCVE-2026-109618 CVE-2026-109619 CVE-2026-111497+24 · 2 reads

Info-stealer slipped into OVHcloud CLI GitHub releases

Tampered builds v0.11.0 through v0.15.0 were live for under two hours on October 19; v0.16.0 is clean.

Help Net Securityupdated Oct 21, 16:50 UTC · 4d agofirst Oct 21, 08:59 UTC · 4d agoMalware 7 sources

Hijacked developer account planted a stealer in OVHcloud CLI

Releases v0.11.0 through v0.15.0 were replaced for about 94 minutes on October 19; v0.16.0 is clean.

SecurityWeekupdated Oct 21, 16:50 UTC · 4d agofirst Oct 21, 06:02 UTC · 4d agoMalware 7 sources

OVHcloud CLI releases 0.11.0–0.15.0 backdoored on GitHub to steal secrets

A hijacked GitHub account pushed trojanized binaries for about 90 minutes on October 19; 0.10.0 and 0.16.0 are clean.

BleepingComputerupdated Oct 21, 16:50 UTC · 4d agofirst Oct 20, 11:31 UTC · 5d agoMalware 7 sources1 · 1 read

OVHcloud CLI GitHub releases briefly served a secret-stealing binary

Compromised builds v0.11.0 through v0.15.0 were online for 94 minutes on October 19 before OVHcloud blocked them.

GBHackersupdated Oct 21, 16:50 UTC · 4d agofirst Oct 20, 11:03 UTC · 5d agoMalware 7 sources

OVHcloud CLI GitHub releases hijacked to spread secret-stealing malware

Malicious builds of v0.11.0 through v0.15.0 were blocked within 94 minutes; v0.16.0 is the clean replacement.

Cyber Security Newsupdated Oct 21, 16:50 UTC · 4d agofirst Oct 20, 09:16 UTC · 5d agoMalware 7 sources2 · 1 read

Hijacked account swapped five OVHcloud CLI releases with a secret-stealer

The swapped archives were live for up to 94 minutes on October 19 and only reached unhashed installs on selected platforms.

The Hacker Newsupdated Oct 21, 16:50 UTC · 4d agofirst Oct 20, 08:21 UTC · 5d agoMalware 7 sources1 · 1 read

Related CVEs

by mentions

CVE-2026-025797%7.8
Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
published May 13, 2026Palo Alto Networks PAN-OS (GlobalProtect portal and gateway)KEVRansomware
CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 4d agophpPoC ×13
CVE-2026-11149733%9.2
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
published 3d agoGoogle BrotliPoC ×16
CVE-2026-10961812%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 4d agophpPoC ×25
CVE-2026-1012969.1
Auth bypass in Apache Tomcat JNDIRealm with non-GSSAPI SASL
published 5d agoApache Tomcat

Appears with

OVHcloudvendor · 7
OpenSourceMalwareorganization · 3
GitHuborganization · 3
GlassWormmalware · 2
Unit 42organization · 1
Apache Tomcatproduct · 1
Wizorganization · 1
UpdraftPlusproduct · 1
GlassWormthreat actor · 1
Cloudflareorganization · 1
OVHcloudvictim · 1
PHPproduct · 1
Node.jsproduct · 1
Mozillaorganization · 1
Apachevendor · 1
GlobalProtectproduct · 1

Entities are extracted by the model from each article. First seen Oct 20, 2026, last mentioned 3d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.