Fedora 44 doctl 1.169.0 Update (FEDORA-2026-ad8394dc92): Cloud CLI Patching and Detection Guidance

---
title: DigitalOcean doctl Execution on Non-Developer Linux Host
description: Detects execution of the DigitalOcean CLI (doctl) on Linux systems. Cloud CLIs on servers, CI runners, or unexpected endpoints may indicate attacker-controlled cloud management, cryptomining droplet provisioning, or data staging.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-doctl-2026-ad8394dc92
  - https://attack.mitre.org/techniques/T1580/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.discovery
  - attack.t1580
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/doctl'
      - '/bin/doctl'
      - '/snap/bin/doctl'
  filter_dev_workstations:
    Hostname|contains:
      - 'dev-'
      - 'wks-'
  condition: selection and not filter_dev_workstations
falsepositives:
  - SRE and platform engineering workstations legitimately managing DigitalOcean resources
  - CI/CD pipelines deploying to DigitalOcean - scope rule to non-CI hosts if needed
level: medium
---
title: DigitalOcean API Token Config File Access
description: Detects read access to the doctl configuration file containing DigitalOcean API tokens. Access by non-doctl processes (shells, scripting interpreters, archive tools) may indicate credential theft.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-doctl-2026-ad8394dc92
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/.config/doctl/config.yaml'
  filter_legit:
    Image|endswith:
      - '/doctl'
      - '/dnf'
      - '/rpm'
  condition: selection and not filter_legit
falsepositives:
  - Backup agents and EDR scanners reading user home directories - allowlist known agent binaries
  - Administrators inspecting configs during troubleshooting
level: high
---
title: doctl Destructive or Provisioning Command Execution
description: Detects doctl subcommands associated with resource creation, deletion, or authentication changes - behaviors consistent with cloud resource hijacking, cryptomining provisioning, or destructive attacks.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-doctl-2026-ad8394dc92
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.impact
  - attack.t1496
  - attack.t1580
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: '/doctl'
  selection_cmd:
    CommandLine|contains:
      - 'droplet create'
      - 'droplet delete'
      - 'auth init'
      - 'auth switch'
      - 'compute snapshot'
      - 'kubernetes cluster delete'
      - 'firewall update'
  condition: all of selection_*
falsepositives:
  - Routine infrastructure management by platform teams - baseline expected operators and droplet patterns
level: high

// Hunt: DigitalOcean doctl execution and token access across Linux estate
let TimeWindow = 7d;
let DoctlHosts = (
    Syslog
    | where TimeGenerated > ago(TimeWindow)
    | where ProcessName =~ "doctl" or SyslogMessage has "doctl"
    | extend CmdLine = tostring(SyslogMessage)
    | where CmdLine has_any ("droplet create", "droplet delete", "auth init", "auth switch", "snapshot", "firewall update", "kubernetes cluster")
    | project TimeGenerated, Computer, HostIP, ProcessName, CmdLine, Source = "Syslog"
);
let TokenAccess = (
    Syslog
    | where TimeGenerated > ago(TimeWindow)
    | where SyslogMessage has "/.config/doctl/config.yaml"
    | where SyslogMessage !has "doctl"
    | project TimeGenerated, Computer, HostIP, ProcessName, CmdLine = tostring(SyslogMessage), Source = "TokenFileAccess"
);
union DoctlHosts, TokenAccess
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), EventCount = count(), Commands = make_set(CmdLine, 10) by Computer, ProcessName, Source
| order by LastSeen desc

-- Hunt: Inventory all doctl binaries and running doctl processes across endpoints
-- Surfaces snap/GitHub/go-install copies that bypass DNF package tracking

SELECT * FROM foreach(
  row={
    SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
    FROM pslist()
    WHERE Name =~ 'doctl' OR CommandLine =~ 'doctl'
  },
  query={
    SELECT 'RUNNING_PROCESS' AS FindingType,
           Pid AS PID, Name, CommandLine, Exe AS Path, Username, CreateTime AS Timestamp
    FROM scope()
  })
UNION ALL
SELECT 'BINARY_ON_DISK' AS FindingType,
       NULL AS PID, NULL AS Name, NULL AS CommandLine,
       FullPath AS Path,
       NULL AS Username,
       Mtime AS Timestamp
FROM glob(globs=[
  '/usr/bin/doctl',
  '/usr/local/bin/doctl',
  '/snap/bin/doctl',
  '/home/*/go/bin/doctl',
  '/home/*/.local/bin/doctl',
  '/opt/**/doctl',
  '/root/go/bin/doctl'
])

#!/bin/bash
# Fedora 44 doctl 1.169.0 update + fleet verification (FEDORA-2026-ad8394dc92)
set -euo pipefail

echo "[*] Applying Fedora advisory FEDORA-2026-ad8394dc92 (doctl 1.169.0)"
sudo dnf upgrade --refresh -y doctl

echo "[*] Verifying installed version"
INSTALLED=$(rpm -q doctl --queryformat '%{VERSION}')
echo "    Installed doctl version: ${INSTALLED}"
if [[ "${INSTALLED}" != "1.169.0" ]]; then
  echo "[!] WARNING: expected 1.169.0, got ${INSTALLED} - check repo mirrors"
  exit 1
fi

echo "[*] Checking for out-of-band doctl installs not managed by DNF"
for p in /usr/local/bin/doctl /snap/bin/doctl /root/go/bin/doctl /home/*/go/bin/doctl /home/*/.local/bin/doctl; do
  [ -e "$p" ] && echo "[!] Unmanaged copy found: $p ($($p version 2>/dev/null | head -1))"
done

echo "[*] Auditing doctl token file permissions"
for cfg in /home/*/.config/doctl/config.yaml /root/.config/doctl/config.yaml; do
  if [ -e "$cfg" ]; then
    PERMS=$(stat -c '%a' "$cfg")
    echo "    $cfg -> permissions ${PERMS}"
    [ "$PERMS" != "600" ] && chmod 600 "$cfg" && echo "    -> tightened to 600"
  fi
done

echo "[+] Done. Review unmanaged copies and rotate tokens on any host with unexpected doctl activity."