Cyber Threat Brief — October 20 2026
⚠️ This report is AI-generated. Always validate findings.
1. OVHcloud-CLI-2026-10 — GitHub release assets swapped for a secret stealer
TL;DR: For about 94 minutes on 19 October, five published OVHcloud CLI GitHub releases served a locally built binary whose job was to read secrets off disk. If you ran one, rotate every secret on that machine from a different host, then install v0.16.0 or later.
What’s New:
- A downstream CI job that pins SHA-256 opened GitHub issue #300 at 13:50 UTC. Maintainer Romain Beuque confirmed the replaced assets were deleted at 16:21 Paris (14:21 UTC) and that v0.16.0 is an immutable release with a signed tag.
- The reporter’s capture shows account
HassenBFreplaced assets on v0.15.0 starting at 12:47 UTC. OVHcloud’s own list of affected tags is v0.11.0 through v0.15.0. v0.10.0 was not replaced. The source tag for v0.15.0 still points at760fd72, and no GitHub Actions release workflow ran during the swap. - The bad Linux arm64 archive is a dirty
go buildof commit5ead8ef(13 October), not the v0.15.0 tag. OpenSourceMalware did not recover the deleted binary, so nobody has published the paths it reads or where it sends them. - The same GitHub account had a hidden
preinstall.jsloader in personal repositories from 5 March. OpenSourceMalware ties that loader to a known GlassWorm Solana wallet. That link is the account, not a sample of the October CLI binary.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
SHA-256 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb | Malicious archive | T1195.002 | File inventory / CI logs | Block and search for 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb. That is the replaced ovhcloud-cli_Linux_arm64.tar.gz from tag v0.15.0. A hit means the swapped archive was downloaded. |
SHA-256 5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0 | Pre-swap archive | T1195.002 | File inventory / CI logs | Treat 5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0 as the original v0.15.0 ovhcloud-cli_Linux_arm64.tar.gz. Do not block this hash. A pipeline that expected it and then failed is how the swap was caught. |
Module version v0.15.1-0.20261013083505-5ead8ef9b43d+dirty | Build metadata | T1195.002 | go version -m on the binary | Run go version -m on any ovhcloud binary you still have. Quarantine the file if the module line is v0.15.1-0.20261013083505-5ead8ef9b43d+dirty or vcs.modified=true. A clean release build has neither. |
| OVHcloud CLI tags v0.11.0 through v0.15.0 | Replaced releases | T1195.002 | Package inventory / shell history | If a host installed tags v0.11.0, v0.12.0, v0.13.0, v0.14.0, or v0.15.0 between 12:47 and 14:21 UTC on 19 October, treat it as exposed. The swapped files were macOS arm64 and x86_64, Linux arm64 and x86_64, and Windows x86_64. i386, Windows arm64, and WASM were left alone. |
| OVHcloud CLI v0.16.0 | Fixed release | T1195.002 | Package inventory | Remove the old binary and install v0.16.0 or later from the immutable release published by ovh-cds. Check the GitHub release attestation before you trust the new archive. |
GitHub account HassenBF | Release uploader | T1078.004 | GitHub audit log | Search GitHub audit logs for HassenBF uploading or deleting release assets on ovh/ovhcloud-cli on 19 October. That account is the uploader the reporter recorded. Revoke tokens it could use. |
Config file ~/.ovh.conf | Secret on disk | T1552.001 | Host file inventory | From a different machine, rotate every OVHcloud API key and consumer key stored in ~/.ovh.conf, then delete the file on the exposed host. Also rotate SSH keys, cloud CLI credentials, and tokens in .env, .npmrc, .pypirc, and .netrc that the host could read. |
SHA-256 43df42fd79f6f81e530892b54634598770d6e496796a863c596e616bcb3fec70 | Account-loader file | T1195.002 | File inventory | Search developer workstations for 43df42fd79f6f81e530892b54634598770d6e496796a863c596e616bcb3fec70, the preinstall.js OpenSourceMalware found on HassenBF personal repositories. This is the March loader, not the CLI archive. |
Solana wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC | Dead-drop address | T1102 | TLS-inspecting proxy logs | Alert when a build host sends a Solana RPC request body that names wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC. DNS logs only show the RPC hostname, not the wallet. OpenSourceMalware decoded that wallet from the March loader. It is not a confirmed callback of the deleted CLI binary. |
File ~/init.json | macOS throttle marker | T1497.003 | File inventory | On macOS, look for init.json in the user home directory. OpenSourceMalware says the March loader writes it and then re-runs at most every two days. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | 3CX Supply Chain Attack Network Indicators matches a 3CX domain lookup only. Linux Possible Access To Credential Files matches cat, vi, vim, or nano reading /etc/passwd or /etc/shadow, not an ovhcloud process. |
| Elastic | None — verified | Sensitive Identity File Open by Suspicious Process via Auditd can match any process name, but only listed root and cluster paths such as /root/.ssh/id_rsa and /root/.aws/credentials. It does not name ~/.ovh.conf, and the CLI payload’s paths were not published. |
| Sigma | None — verified | No rule names ovhcloud, HassenBF, or the archive hash. SSH rules in the snapshot are tunnels and daemon errors, not a Go CLI reading a config file. |
Hunt hint: Check shell history and CI logs for install.sh from raw.githubusercontent.com/ovh/ovhcloud-cli and for brew install --cask ovh/tap/ovhcloud-cli or brew upgrade between 12:47 and 14:21 UTC on 19 October. OpenSourceMalware says those paths fetched the release URL. go install, a source build, and the ovhcom/ovhcloud-cli Docker image did not. On a binary you still have, ovhcloud version prints the tag on a clean build and does not on the swapped one, because the version ldflag was missing. Rotate secrets from a machine that did not run the swapped binary. There is still no published command-and-control host for that binary.
Sources: GitHub issue #300 · OpenSourceMalware
2. RankMath-SEO-Pro-3.0.123 — backdoored SEO plugin downloads
TL;DR: Some Rank Math PRO 3.0.123 downloads between 15 October 20:02 UTC and 16 October 07:12 UTC contained malware that rebuilds a backdoor on each page view. If that copy was activated, restore the site from a backup taken before the window, then install 3.0.124.
What’s New:
- Rank Math’s own notice says only the PRO package from that 11-hour window is affected. Deactivating the plugin or moving to 3.0.124 does not remove the backdoor. The free Rank Math SEO plugin on WordPress.org is not part of this incident.
- The backdoor can recreate itself when someone visits the site. Rank Math says to delete the
rank-math-profolder and threewp_optionsrows, and to blockrank1cdn.com, before deleting other files. - The same notice names a fake core file, administrator names beginning
wpsupport_, mail at@wp-mail.net, and a crontab tag#ms6v46. It also says the web server user may have changed SSH keys and files outside WordPress. - BleepingComputer found a VirusTotal PHP sample that carries the same markers, including the XOR key
xmmqhn. They could not show that this file shipped inside the plugin zip.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Rank Math PRO 3.0.123 | Affected package | T1195.002 | WordPress plugin list | If Rank Math PRO shows version 3.0.123 and it was downloaded or updated between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC, treat an activated site as compromised. Delete the rank-math-pro directory. Do not stop at deactivation. |
| Rank Math PRO 3.0.124 | Clean package | T1195.002 | WordPress plugin list | After the site is restored or cleaned, install Rank Math PRO 3.0.124 downloaded from rankmath.com while logged in. Do not use a plugin zip from email. |
Domain rank1cdn.com | Callback domain | T1071.001 | DNS / proxy logs | Block outbound connections to rank1cdn.com and search DNS and proxy logs for that domain. Rank Math names it as the malware’s domain. |
File wp-includes/class-wp-cache-util.php | Fake core file | T1505.003 | File inventory | Delete wp-includes/class-wp-cache-util.php if it exists. It is not a WordPress core file. Run wp core verify-checksums afterward. Delete the plugin folder and the option rows first, or a visit can recreate the file. |
Option _uf6qdn2hmm | Database marker | T1505.003 | wp_options | Delete the wp_options row whose option_name is _uf6qdn2hmm. Rank Math says this row is part of the rebuild mechanism. |
Option t8krdk990phb | Database marker | T1505.003 | wp_options | Delete the wp_options row whose option_name is t8krdk990phb. |
Option _np5pvf754c | Database marker | T1505.003 | wp_options | Delete the wp_options row whose option_name is _np5pvf754c. |
Username prefix wpsupport_ | Backdoor account | T1136.001 | wp_users | Run wp user list --role=administrator and delete unfamiliar administrators whose login starts with wpsupport_. |
Email suffix @wp-mail.net | Backdoor account | T1136.001 | wp_users | Delete users whose email address ends in @wp-mail.net unless you issued that address. Rank Math names that suffix on the rogue administrators. |
Crontab tag #ms6v46 | Host persistence | T1053.003 | System crontab | On the web server user, search crontab for #ms6v46 and remove that entry. Also run wp cron event list and remove events you did not create. |
XOR key xmmqhn | File marker | T1505.003 | File search on the web root | Search PHP under wp-content/mu-plugins/, other plugin directories, and theme inc/, includes/, and lib/ folders for xmmqhn together with base64_decode. Quarantine matching files. This string is from Rank Math’s cleanup note. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | WordPress Bricks Builder plugin RCE matches POST /wp-json/bricks/v1/render_element only. |
| Elastic | Partial — PHP File Creation in WordPress Plugin Directory | Fires when nginx, Apache, php-fpm, or a shell writes any file under wp-content/plugins/. It does not see wp-includes/class-wp-cache-util.php. A normal plugin install hits it too. |
| Sigma | None — verified | Linux Webshell Indicators requires children such as whoami or cat under the web server. Suspicious Process By Web Server Process is Windows and expects those same recon children. The published markers are a PHP file, options, and a cron tag. |
Detection index: ESCU c7c103b (2026-10-20) · elastic detection-rules 3cff483 (2026-10-19) · SigmaHQ e3f4662 (2026-10-20).
Hunt hint: Restore files and the database from a backup taken before 2026-10-15 20:02 UTC if the plugin was activated. If you cannot, delete rank-math-pro and the three option rows before you delete wp-includes/class-wp-cache-util.php. Then search .htaccess for rules that execute .cache files as PHP, search uploads/ for PHP, and review authorized_keys and other users’ crontabs. Rotate the database password in wp-config.php, WordPress salts, administrator passwords, and API keys the site could read. A site that only downloaded 3.0.123 and never installed it is not compromised by this notice alone.
Sources: Rank Math · BleepingComputer
Status Updates
- CVE-2026-102764 (BeyondTrust Remote Support): KEV due date was Oct 19 and is now overdue. Forensic triage still required. No public PoC. Self-hosted 26.2.3 and older need the BT26-05-RS patch. Original brief.
- CVE-2025-61624 (FortiOS auto-script path traversal / PEERSTITCH): KEV due date was Oct 19 and is now overdue. Forensic triage still required. Original brief.
- CVE-2026-21589 (Atlassian Data Center file read): KEV due date was Oct 18 and remains overdue. Forensic triage still required. Original brief.
- ConnectWise-CloudBackup-SkyKick-2026-10: The Oct 20 trust update still has Cloud Backup, SaaS Security, and Cloud Management suspended. Huntress says only
144.172.64.128produced application sign-ins in its review; it does not tie144.172.64.99,144.172.64.60, or144.172.94.243to those sign-ins. A second tenant repeated the Global Administrator grant and secret planting. Original brief. - CVE-2026-0257 (PAN-OS GlobalProtect): Unit 42’s Oct 19 update adds Inc (Tarnished Scorpius) beside Qilin, then a pivot from the gateway to vCenter, disabling ESXi
execInstalledOnly, and an offline domain-controller VMDK dump. An older paragraph on that page still says no post-access behavior was identified. Returned to the watch list. Original brief. - KEV deadlines already passed, no new fix or IOC: CVE-2026-0322 (PAN-OS) and CVE-2026-76519 (Cisco Secure Email Gateway; AsyncOS 16.0 still has no fixed build in cisco-sa-esa-afw-zqYJkjxp, so migrate to 15.5.5-014 or 16.5.0-780, or confirm Content Scanner Tools 25.3.0.5525 or later) (brief); CVE-2026-105134 and CVE-2026-105133 (AhsayCBS) (brief); CVE-2026-104935 (Ivanti) and CVE-2026-96951 (Windows Shell) (brief); CVE-2026-86950 (Apple CoreGraphics, becomes retire-due on Oct 21 if nothing changes) (brief).
- Deferred, single origin on the exploitation claim: Redis CVE-2026-25243 (Cyber Centre AV26-423 only restates open-source reporting; fixed in 8.6.3 or ACL-restrict RESTORE; recheck Oct 23); SiteGuard CVE-2026-106931 (no second origin, not in KEV; recheck Oct 23); Siemens Software Center CVE-2026-110936 (Siemens validated it; Huntress and Forescout have not named this product; fixed in 4.0.9.8; recheck Oct 22).
- Deferred, carried: OpenCode Console still has no indicators, so rotate provider keys saved there (recheck Oct 23). Langflow CVE-2026-105740 (recheck Oct 23). Drupal SA-CORE-2026-014 / CVE-2026-108097: a relay describes a lab PoC on 11.4.9 that fails on 11.4.10; the repository was not opened; no compromise claim (recheck Oct 21). ROMULUS ClickFix (recheck Oct 21).
- Retired from watch (last update 2026-10-06): CVE-2026-86360 (Dell System Update). No KEV entry, no new fix, and no new exploitation report.
- Retired from deferred: npm
imgdecode1.0.0–1.0.3 is still on the registry. Still one origin (SafeDep) and not in KEV. - Watching (no change): UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); CVE-2026-110447 (10-15); CVE-2026-102255 (10-15); Danfoss-AKSM-FROMAGEGATE-2026-10 (10-13); CVE-2026-97229 (10-13); CVE-2026-85097 (10-09); CVE-2026-107406 (10-09); CVE-2026-82077 (10-11); CVE-2026-61500 (10-04); CVE-2026-88062 (10-04); ClickFix-CacheSmuggle-2026-10 (10-07); CVE-2026-102406 (10-07); CVE-2026-103007 (10-07); FortiBleed-2026-10 (10-08); tensorlake-npm-0.5.144 (10-08); CVE-2026-105192 (10-08); CyberXero-2026-10 (10-12); GhostAction-2026-10 (10-10); UpdraftCentral-2026-10 (first covered 2026-10-19; production URL returned 404 at write time, so no link).