Affected Systems

OVHcloud CLI versions 0.11.0 through 0.15.0 on macOS (Intel/ARM), Linux (x86_64/ARM64), and Windows x86-64. Compromised releases available October 19, 2026 from 14:47 to 16:21 UTC. Version 0.10.0 and earlier, plus 0.16.0 are clean. Source builds and Docker images unaffected.

Exploitation Status

Active supply chain attack detected in production. Attacker compromised developer GitHub account for 6+ months, disabled release immutability to bypass CI/CD checks. Linked to GlassWorm threat actor active since late 2025 targeting developer ecosystems (VSCode, npm, GitHub).

Business Impact

Developers and system administrators who installed affected CLI versions between October 19 14:47-16:21 are at risk of credential theft. Malware targets secrets stored on disk including API keys, cloud credentials, and authentication tokens. Attackers bypassed all CI/CD security checks by modifying immutable releases directly. Organizations using OVHcloud for infrastructure management face potential lateral movement risk if developer credentials were harvested.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately identify systems that downloaded OVHcloud CLI versions 0.11.0-0.15.0 on October 19, 2026 via package manager logs or endpoint detection tools
  • Uninstall compromised versions and upgrade to OVHcloud CLI 0.16.0 or rollback to 0.10.0
  • Rotate all credentials, API keys, SSH keys, and secrets stored on affected developer workstations including OVHcloud account credentials, cloud provider keys, and repository access tokens
  • Review access logs for OVHcloud infrastructure and related services for unauthorized activity from October 19 onward
  • Enable GitHub release immutability and require signed commits for all internal repositories hosting CLI tools or automation scripts

---

# Geopolitical Context

Geopolitical Context

The compromise of OVHcloud's open-source CLI tool represents a continuation of supply chain attacks targeting the software development ecosystem. OVHcloud, a major French cloud provider and Europe's largest hosting company, serves critical infrastructure across European markets. The attack methodology—hijacking a developer's GitHub account to inject malware into trusted tooling—reflects an ongoing pattern of adversaries exploiting the open-source supply chain to gain access to downstream enterprise environments. The incident occurred amid heightened European focus on digital sovereignty and supply chain security, particularly as member states work to reduce dependencies on non-European cloud providers. The targeting of a European cloud infrastructure provider's developer tools may indicate adversary interest in mapping or accessing cloud-hosted assets across the continent, though no specific geopolitical motivation has been confirmed.

State Actor Alignment

The attack is attributed by third-party researchers to GlassWorm, a threat cluster active since late 2025 that has systematically targeted software development ecosystems including VSCode, OpenVSX, GitHub, and npm. No direct state-actor attribution has been publicly established for GlassWorm operations. The campaign's characteristics—credential theft, long-term account compromise (over six months), and use of cryptocurrency dead drops for command-and-control—are consistent with both financially-motivated cybercrime and espionage-focused intrusion activity. The lack of public government attribution or sanctions designations suggests either insufficient intelligence linking the activity to a specific state sponsor, or that affected governments have not yet chosen to publicly attribute the campaign. French cybersecurity authorities (ANSSI) have not issued public statements linking this incident to state-sponsored activity.

Business Impacty pro region

The compromise has immediate implications for European cloud infrastructure security and the broader open-source software supply chain. OVHcloud serves approximately 1.6 million customers globally, with significant concentration in France and across EU member states, meaning the attack potentially exposed credentials and secrets across European government, enterprise, and critical infrastructure sectors. The incident underscores vulnerabilities in the open-source development model that European digital sovereignty initiatives rely upon—the EU's proposed Cyber Resilience Act and ongoing discussions around securing open-source software supply chains gain additional urgency. For European cloud providers competing against U.S. hyperscalers, security incidents of this nature may complicate market positioning around trustworthiness and resilience. Globally, the attack reinforces concerns about GitHub as a single point of failure in software supply chains, with implications for development practices across all regions. The multi-platform nature of the compromise (Windows, Linux, macOS) suggests broad potential impact across diverse computing environments.

Forecast

If GlassWorm operations continue to target major open-source development tools and repositories, additional supply chain compromises affecting European and global software ecosystems are likely in the coming months. Organizations that downloaded affected OVHcloud CLI versions should anticipate potential follow-on intrusion activity if credentials were successfully exfiltrated, particularly targeting cloud infrastructure and hosted services. If the compromised developer account was accessed through credential theft or social engineering rather than technical vulnerability, similar account takeovers affecting other maintainers of widely-used open-source projects may emerge. European regulatory responses are likely to accelerate, with potential new requirements for repository security controls, multi-factor authentication enforcement, and supply chain attestation—particularly as the Cyber Resilience Act implementation proceeds. If attribution to a state-sponsored actor is eventually established, diplomatic responses and potential sanctions designations may follow, though the current absence of public attribution suggests this remains uncertain.