OVH CLI compromised. Should have used buy_ovh.

fredo1664 · October 20

In French: https://www.frandroid.com/culture-tech/securite-applications/3291645_ovhcloud-alerte-ses-clients-changez-tous-les-secrets-stockes-sur-votre-pc?utm_medium=distibuted&utm_source=reddit&utm_content=directlink&utm_campaign=3291645

In English: https://runtimewire.com/article/ovhcloud-cli-compromised-secrets-october-2026

Octave Klaba (@olesovhcom), OVHcloud's founder and CEO, warned users on October 19th that compromised versions of the company's command-line interface contained a binary designed to collect secrets from users' computers. Klaba said an attacker used a developer's GitHub account to add the binary. His post on X named versions 0.11.0 through 0.15.0 as compromised, and versions 0.10.0 and 0.16.0 as clean.

rpqu · October 20

Fuck

USTC · October 20

That sounds truly terrifying.

JohnFilch123 · October 20

@USTC said:
That sounds truly terrifying.

don't be truly terrified, life is full of surprises.

JabJab · October 20

The 14:47 CLI version was compromised by a hacker. We detected and blocked it at 16:21. Thanks to the customer who reported the issue to us

"We detected" as in customer handed out everything to us.
Cool

NotFoundException · October 20

MaxTakeba · October 20

@JabJab said:

The 14:47 CLI version was compromised by a hacker. We detected and blocked it at 16:21. Thanks to the customer who reported the issue to us

"We detected" as in customer handed out everything to us.
Cool

Honestly the customer deserves a ton of praise.
OVH for such a rapid response too and not claiming it was something else.

To be clear, you are safe if you did not download it in the last 24 hours~

You are likely fucked if you did in that 24 ish hour window, and you should be rotating passwords and ensuring MFA is on, killing any and all API keys.