VulnHub

Real-time Cybersecurity News

Critical

Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

The Hacker News
Actively Exploited
Malware

Overview

On October 19, 2023, an attacker compromised a contributor's GitHub account and replaced the download files for five versions of OVHcloud's command-line interface (CLI) tool. These altered files contained malware designed to steal sensitive information from the machines running them. The malicious versions were available on GitHub for approximately 94 minutes, from 12:47 to 14:21 UTC, before being removed. This incident poses a significant risk to users who downloaded the compromised versions, as their stored secrets could be accessed by the attackers. OVHcloud's response underscores the need for vigilance in open-source projects, where account security is crucial to prevent similar incidents.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: OVHcloud command-line interface (CLI) tool
  • Action Required: Users should delete any downloaded versions of the affected OVHcloud CLI releases and ensure their systems are secure.
  • Timeline: Newly disclosed

Original Article Summary

An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC,

Impact

OVHcloud command-line interface (CLI) tool

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should delete any downloaded versions of the affected OVHcloud CLI releases and ensure their systems are secure. It's also advisable to monitor for any suspicious activity on machines that may have run the compromised software.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

Ex-OpenAI Engineer Held Over Secret Recorder, Saudi Ties

darkreading

Abdulrahman Alfozan, a former engineer at OpenAI, has been arrested and detained on suspicion of installing a secret recording device in an OpenAI conference room. A judge ordered his detention earlier this month, indicating the seriousness of the charges. Alfozan's actions raise significant concerns about security and privacy within tech companies, particularly those involved in sensitive AI research. The incident could have broader implications for how companies protect their internal communications and intellectual property from potential espionage. As investigations continue, the tech community is watching closely to see how this case unfolds and what it might mean for future security protocols.

Oct 20, 2026

US Agencies Detail Incident Response Practices for Rogue AI Agents

SecurityWeek

The National Institute of Standards and Technology (NIST), along with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA), has released a set of ten voluntary practices aimed at helping organizations prepare for and manage incidents involving rogue AI agents. These guidelines cover a variety of stages, including preparation, detection, response, recovery, and reporting of such incidents. The move comes amid growing concerns that AI technologies could be misused to carry out harmful activities. Organizations across various sectors are encouraged to adopt these practices to enhance their security posture against potential AI-related threats. This initiative reflects an increasing recognition of the need to address the unique challenges posed by artificial intelligence in the cybersecurity landscape.

Oct 20, 2026

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

The Hacker News

Researchers have disclosed a significant vulnerability in Fortinet's FortiSIEM product that could allow attackers to execute arbitrary code without authentication. This flaw, identified as CVE-2026-106173, has a CVSS score of 9.4, indicating its critical nature. An unauthenticated attacker could exploit this path traversal vulnerability to run unauthorized commands on affected systems. Given the potential for severe impacts, organizations using FortiSIEM need to take this threat seriously. The release of a proof-of-concept exploit makes it imperative for users to apply security patches promptly to safeguard their environments.

Oct 20, 2026

Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

The Hacker News

Palo Alto Networks has reported ongoing exploitation of a significant security flaw in its PAN-OS and Prisma Access products, identified as CVE-2026-0257. This vulnerability, which has a CVSS score of 7.8, allows attackers to bypass multi-factor authentication and create unauthorized VPN connections. Although the flaw was patched in May 2026, ransomware groups, including Qilin and INC, are still actively using this exploit to target organizations. This is particularly concerning for businesses relying on these systems for secure remote access, as it can lead to unauthorized access to sensitive data. Companies should ensure they have applied the latest patches and monitor their systems for any signs of exploitation.

Oct 20, 2026

Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree

darkreading

A Chinese-speaking hacker has exploited an AI penetration testing tool called Cairn to automate attacks on hundreds of websites worldwide. Notable targets include major companies like John Deere, SharkNinja, and Cummins, leading to significant data theft and potential financial losses. The use of Cairn, typically designed for security testing, in this manner raises concerns about the accessibility of such tools for malicious use. This incident highlights the ongoing risks businesses face from cybercriminals who can leverage advanced technologies to carry out large-scale attacks. Companies need to enhance their cybersecurity measures to defend against these evolving threats.

Oct 20, 2026

DHS bans DeepSeek products across US federal civilian agencies

BleepingComputer

The U.S. Department of Homeland Security (DHS) has mandated that all federal civilian agencies discontinue the use of DeepSeek products and remove them from their systems. This action raises concerns about the security of these products, prompting the government to act decisively to protect sensitive data and systems. The DHS did not specify the exact reasons for the ban, but it indicates a serious concern regarding the potential risks posed by DeepSeek solutions. The directive affects all federal agencies, emphasizing the importance of maintaining secure technology within government operations. The implications of this order could lead to further scrutiny of other software products used by the government, as officials seek to bolster cybersecurity across federal networks.

Oct 20, 2026