Dan's Brief
← 2026-10-19

Five OVHcloud CLI releases swapped for secret-stealing malware via hijacked account

Published 7:01 AM · 120 articles from 15 sources · about 5 min to read in full

The day in brief

Software supply-chain attacks dominate the day. Attackers hijacked a contributor's GitHub account and swapped five OVHcloud CLI release archives for secret-stealing malware, live for up to 94 minutes. Rank Math PRO copies distributed October 15-16 carried a self-restoring backdoor, and AOMEI's update servers were reportedly used to push malware. Separately, F5 shipped out-of-band NGINX patches for three critical code-execution flaws, and Plex2Shell, a chain of four Plex Media Server bugs, is being exploited to install crypto miners and a Linux proxy backdoor. These share one lesson: trusted distribution channels are being attacked, and patching has to be paired with verifying what you install. AI shows up on both sides. Norforge reports a largely autonomous agent army breached over 100 websites. Terra reports a rise in security fixes that were reported broken within 90 days, and Linux 7.4 is removing old drivers because of AI-generated fixes. Patch risk also continues: Microsoft's October Exchange update changed a default and broke OWA. Outside security, CoreWeave's bonds turned distressed and Microsoft dropped a UK AI supercomputer over grid delays, so power and debt are now the limits on AI buildout.

Top stories

  1. 1
    Five OVHcloud CLI releases swapped for secret-stealing malware via hijacked account

    Attackers took over a contributor's GitHub account and replaced five OVHcloud CLI release archives with malware that steals secrets. The tampered files were live for up to 94 minutes. Anyone who downloaded a release in that window should treat credentials on that machine as exposed and rotate them. The Hacker News

  2. 2
    F5 ships out-of-band NGINX patches for three critical flaws

    F5 released unscheduled patches fixing multiple NGINX vulnerabilities, including three critical ones that allow code execution on affected systems. An out-of-band release signals urgency, and NGINX commonly sits at the network edge. The summary gives no CVE ids or fixed versions, so check F5's advisory. BleepingComputer

  3. 3
    Rank Math PRO downloads from the official site carried a self-restoring backdoor

    Copies of the WordPress SEO plugin distributed October 15-16 contained a backdoor that restores itself after removal, so affected sites should be treated as compromised. The malicious files came from the vendor's own site, so ordinary update hygiene did not protect users. Deleting the plugin is not enough. The Hacker News

  4. 4
    Plex2Shell chain of four Plex flaws is being exploited in the wild

    Attackers chain four Plex Media Server vulnerabilities to install crypto miners and a Linux proxy backdoor on unpatched servers. A researcher is urging immediate patching. A proxy backdoor can turn a home or small-office server into a relay for other attacks. The Hacker News

  5. 5
    Norforge: AI agent army breached over 100 websites including John Deere

    Norforge reports an attacker used a largely autonomous swarm of AI agents to break into more than 100 sites, reportedly including John Deere and SharkNinja. The claim comes from the research group, and the summary gives no technical detail or independent confirmation. If accurate, it shows attack volume scaling without added human operators. The Verge

Since yesterday

  • OpenCode: TechCrunch now reports hackers stole some users' API keys and ran up charges on their AI accounts. That confirms the keys were used, though the number of affected users is not given. TechCrunch ↗
  • Exchange: the Register reports the October updates changed a default, which broke OWA and caused mail queue backlogs on busy servers. This gives a cause, but no fix or workaround is reported. The Register ↗
  • Broadcom Wi-Fi: a researcher says Broadcom has known of the flaw since 2018, and it could affect millions of devices. That is broader than the Belgian ISP routers reported earlier. No patch is mentioned. The Register ↗
  • Linux 7.4 merge window: Phoronix reports a generic two-byte cmpxchg() emulation, and signals that some old CPU architectures may lose kernel support. About 17k lines of new Rust are also queued. Phoronix ↗

By topic

Themes today

Read the analysis →
  • Attackers now poison release channels, not just code
  • AI is raising attacker tempo and maintainer workload
  • Patching itself has become an outage risk
  • Power and debt now limit AI buildout
Written by claude-sonnet-5-5 from feed titles and summaries. The model can misstate details; every claim links to its source.