Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed…
Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers
In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol d…
Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials
A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real serv…
Azure DevOps MCP Flaw: How to Lock Down Your AI Review Agent Before Microsoft Patches It
A practical checklist for the Azure DevOps MCP flaw that lets hidden PR comments hijack AI coding agents, plus the configuration changes to make right now.Azur…
Amazon Q’s MCP Flaw Is an Industry Warning: AI Tools Still Lack Workspace Trust Standards
CVE-2026-12957 in Amazon Q is the third MCP auto-execution vulnerability in three AI coding tools. The pattern reveals a shared design failure, not just a sing…
Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain
Cybersecurity researchers have discovered a critical "by design" weakness in the Model Context Protocol's (MCP) architecture that could pave the way for remote…
Severe Figma MCP Vulnerability Lets Hackers Execute Code Remotely — Patch Now
Cybersecurity researchers have disclosed details of a now-patched vulnerability in the popular figma-developer-mcp Model Context Protocol (MCP) server that cou…
Severe Framelink Figma MCP Vulnerability Lets Hackers Execute Code Remotely
Cybersecurity researchers have disclosed details of a now-patched vulnerability in the popular figma-developer-mcp Model Context Protocol (MCP) server that cou…
Critical mcp-remote Vulnerability Enables Remote Code Execution, Impacting 437,000+ Downloads
Cybersecurity researchers have discovered a critical vulnerability in the open-source mcp-remote project that could result in the execution of arbitrary operat…
MCP Security Flaw in Google Toolbox Could Expose Server Files
An MCP security flaw in Google's open-source Toolbox for Databases could let an attacker copy files off the server running it or replace files on that machine.
MCP Toolbox Flaw Could Expose Google Service Tokens
A September 23 advisory describes a flaw in the Python SDK used with MCP Toolbox: a shared cache could send a Google ID token to a service it was not meant for.
openSUSE Tumbleweed mcphost Moderate Update for 2 Issues 2026-11366-1
An update for mcphost-0.34.0-9.1 on openSUSE Tumbleweed addresses two security vulnerabilities with moderate ratings, allowing installation to enhance system s…
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer o…
Cursor AI Code Editor Vulnerability Enables RCE via Malicious MCP File Swaps Post Approval
Cybersecurity researchers have disclosed a high-severity security flaw in the artificial intelligence (AI)-powered code editor Cursor that could result in remo…
Critical Vulnerability in Anthropic's MCP Exposes Developer Machines to Remote Exploits
Cybersecurity researchers have discovered a critical security vulnerability in artificial intelligence (AI) company Anthropic's Model Context Protocol (MCP) In…
Ubuntu 5690-1: libXdmcp vulnerability
libXdmcp could be made to expose sensitive information.
openSUSE Leap 16.0 mcphost Resolves Key Denial of Service Vulnerabilities
An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed.
SUSE 2026-23496-1 mcphost Moderate DoS Resource Exposure
An update that solves two vulnerabilities can now be installed.
openSUSE mcphost Important Security Update DoS Issues 2026-21120-1
An update that solves 20 vulnerabilities and has 4 bug fixes can now be installed.
openSUSE Tumbleweed mcphost Moderate Security Issues 2026-10731-1
An update that solves 3 vulnerabilities can now be installed.
openSUSE: mcphost 0.32.0-1.1 Moderate Security Flaws 2026:10042-1
An update that solves 3 vulnerabilities can now be installed.
Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover
A recently disclosed critical security flaw impacting nginx-ui, an open-source, web-based Nginx management tool, has come under active exploitation in the wild…
Mageia 2023-0144: libheif security update
Vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to caus…
Mageia 2022-0087: libtiff security upda
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead…