OVHcloud's command-line tool releases were tampered with after an attacker gained control of a developer's GitHub account and uploaded malicious binaries for versions 0.11.0 through 0.15.0. The compromised release appeared on October 19 and was flagged and blocked within two hours after a customer report. OVHcloud CEO Octave Klaba confirmed older 0.10.0 and the newest 0.16.0 were clean, that CI/CD pipelines were not altered, and that GitHub's release immutability setting had been disabled but has since been re-enabled. Users who installed the affected packages were urged to remove or update the CLI and to perform full system cleanup and secret revocation.
Threat researchers at OpenSourceMalware link the incident to the GlassWorm campaign that has targeted developer ecosystems since late 2025, noting the attacker uploaded locally built, trojanized binaries rather than poisoning build pipelines. Analysis of the compromised account shows long-term access with a scripted history rewrite and a hidden loader that uses a Solana memo dead drop for a second stage. The backdoor targets secrets on disk and affected macOS (Intel/ARM), Linux (x86_64/ARM64), and Windows x86-64 binaries; source builds and Docker images were not impacted. Anyone who ran an affected binary must assume credentials and keys were exposed.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.