SPIN Unprocessed October 22, 2026 ai_technology cybersecurity
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
View original on thehackernews.comOverview
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September
SpinGraph analysis pending — check back after processing.
Ask AI about this story
Opens with the SpinGraph .md URL and structured context — one click, prompt included.
More from The Hacker News
View all →- LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
- Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Markdown (.md) · JSON-LD schema (.json) · Machine-readable for AI & GEO