OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

The Hacker News - Oct 22, 2026

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

Read full article

More News

First human case of Shamonda virus detected in France, officials say

First human case of Shamonda virus detected in France, officials say

The disease, which usually affects cattle, has been identified in a patient who died in early October.

Oct 22, 2026See more

Airbnb bans hosts from demanding guests strip beds and wash up - as new rules are branded a 'nightmare' and furious owners threaten to QUIT

Airbnb bans hosts from demanding guests strip beds and wash up - as new rules are branded a 'nightmare' and furious owners threaten to QUIT

The accommodation giant's major shake-up has sparked a furious backlash, with some property owners warning they may take their homes elsewhere.

Oct 22, 2026See more

Is the iPhone Duo a gimmick or is time to join the foldable revolution? SHIVALI BEST tests Apple's £2,000 device to find out if two screens are really better than one

Is the iPhone Duo a gimmick or is time to join the foldable revolution? SHIVALI BEST tests Apple's £2,000 device to find out if two screens are really better than one

The device folds open like a book, transforming from a regular-sized smartphone into a mini tablet. But is it just a £2,000 gimmick, or is it finally time to embrace...

Oct 22, 2026See more

Can Maya Jama and James Acaster get away with murder in plain sight? Psychologist reveals whether Celebrity Traitors' risky yawning tactic will REALLY work

Can Maya Jama and James Acaster get away with murder in plain sight? Psychologist reveals whether Celebrity Traitors' risky yawning tactic will REALLY work

Celebrity Traitors fans were left on the edge of their seats at the end of the last episode, which saw Traitors Maya Jama and James Acaster attempt to murder a...

Oct 22, 2026See more

Two storms in two days as Austen and Boelo target UK

Two storms in two days as Austen and Boelo target UK

The Met Office has named a new storm, Boelo, which is set to bring another round of stormy weather to the UK over the weekend.

Oct 22, 2026See more

What's the healthiest way to eat beef? Top nutritionist on why steak isn't that bad for you after all - even a burger might be better than chicken

What's the healthiest way to eat beef? Top nutritionist on why steak isn't that bad for you after all - even a burger might be better than chicken

Here, experts reveal how to enjoy beef without worrying about the potential impact on your health. With a few simple tweaks, even steaks can be part of your health kick...

Oct 22, 2026See more

Little-known eMudhra set the internet on red alert. What really happened?

India’s only certificate issuer trusted by browsers worldwide, eMudhra, is under scrutiny after a researcher found weak security keys in its website certificates. The company calls it a technical flaw,...

Oct 22, 2026See more

Worldwide website emergency explained: How a critical PHP weakness sparked a global cybersecurity alert - and exactly what it means for you

Worldwide website emergency explained: How a critical PHP weakness sparked a global cybersecurity alert - and exactly what it means for you

A critical weakness has gone unnoticed in the very foundations of the internet for decades, but now AI has triggered a global cybersecurity alert by bringing it to light.

Oct 22, 2026See more

Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb

Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb

It has been a dramatic, public and global response, but the cyber event hasn't happened yet.

Oct 22, 2026See more

'500 new vulnerabilities' found in government, says AI minister

'500 new vulnerabilities' found in government, says AI minister

'500 new vulnerabilities' found in government, says AI minister

Oct 22, 2026See more

NASA competition model 2.0 cuts mission selection by 45%

NASA competition model 2.0 cuts mission selection by 45%

NASA competition model 2.0 cuts mission selection by 45%Getting a Discovery or New Frontiers mission from announcement to second-step selection currently takes NASA about 35 months. Under a new plan,...

Oct 22, 2026See more

Recommended