highSupply chaincontainedCVSS 8.622 Oct 2026
OVHcloud tooling
Hackers slipped a password stealer into a cloud company's official tool
What happened
A build pipeline compromise delivered a credential stealer inside an official OVHcloud client tool. Signed binaries are not automatically safe when the signing pipeline is shared.
Timeline
22 Oct 2026 · 11:00 UTC
Detection
A build artifact is found to contain unexpected code.22 Oct 2026 · 17:00 UTC
Withdrawal
The affected release is pulled from distribution.23 Oct 2026 · 08:00 UTC
Rotation
Customers are told to rotate API credentials and SSH keys.
Sources