OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

The Hacker News - Oct 22, 2026

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

Read full article

MORE NEWS

First human case of Shamonda virus detected in France, officials say

Oct 22, 2026

First human case of Shamonda virus detected in France, officials say

The disease, which usually affects cattle, has been identified in a patient who died in early October.

Airbnb bans hosts from demanding guests strip beds and wash up - as new rules are branded a 'nightmare' and furious owners threaten to QUIT

Oct 22, 2026

Airbnb bans hosts from demanding guests strip beds and wash up - as new rules are branded a 'nightmare' and furious owners threaten to QUIT

The accommodation giant's major shake-up has sparked a furious backlash, with some property owners warning they may take their homes elsewhere.

Is the iPhone Duo a gimmick or is time to join the foldable revolution? SHIVALI BEST tests Apple's £2,000 device to find out if two screens are really better than one

Oct 22, 2026

Is the iPhone Duo a gimmick or is time to join the foldable revolution? SHIVALI BEST tests Apple's £2,000 device to find out if two screens are really better than one

The device folds open like a book, transforming from a regular-sized smartphone into a mini tablet. But is it just a £2,000 gimmick, or is it finally time to embrace the dual-screen life?

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

Oct 22, 2026

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

Can Maya Jama and James Acaster get away with murder in plain sight? Psychologist reveals whether Celebrity Traitors' risky yawning tactic will REALLY work

Oct 22, 2026

Can Maya Jama and James Acaster get away with murder in plain sight? Psychologist reveals whether Celebrity Traitors' risky yawning tactic will REALLY work

Celebrity Traitors fans were left on the edge of their seats at the end of the last episode, which saw Traitors Maya Jama and James Acaster attempt to murder a Faithful in plain sight.

Two storms in two days as Austen and Boelo target UK

Oct 22, 2026

Two storms in two days as Austen and Boelo target UK

The Met Office has named a new storm, Boelo, which is set to bring another round of stormy weather to the UK over the weekend.

What's the healthiest way to eat beef? Top nutritionist on why steak isn't that bad for you after all - even a burger might be better than chicken

Oct 22, 2026

What's the healthiest way to eat beef? Top nutritionist on why steak isn't that bad for you after all - even a burger might be better than chicken

Here, experts reveal how to enjoy beef without worrying about the potential impact on your health. With a few simple tweaks, even steaks can be part of your health kick...

Little-known eMudhra set the internet on red alert. What really happened?

Oct 22, 2026

Little-known eMudhra set the internet on red alert. What really happened?

India’s only certificate issuer trusted by browsers worldwide, eMudhra, is under scrutiny after a researcher found weak security keys in its website certificates. The company calls it a technical flaw, not a breach.

Worldwide website emergency explained: How a critical PHP weakness sparked a global cybersecurity alert - and exactly what it means for you

Oct 22, 2026

Worldwide website emergency explained: How a critical PHP weakness sparked a global cybersecurity alert - and exactly what it means for you

A critical weakness has gone unnoticed in the very foundations of the internet for decades, but now AI has triggered a global cybersecurity alert by bringing it to light.

Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb

Oct 22, 2026

Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb

It has been a dramatic, public and global response, but the cyber event hasn't happened yet.

'500 new vulnerabilities' found in government, says AI minister

Oct 22, 2026

'500 new vulnerabilities' found in government, says AI minister

'500 new vulnerabilities' found in government, says AI minister

NASA competition model 2.0 cuts mission selection by 45%

Oct 22, 2026

NASA competition model 2.0 cuts mission selection by 45%

NASA competition model 2.0 cuts mission selection by 45%Getting a Discovery or New Frontiers mission from announcement to second-step selection currently takes NASA about 35 months. Under a new plan, called Competition Model 2.0, the agency wants it done in about 19.5.NASA's science chief, Nicola...

RECOMMENDED

Science Thread

Science Thread delivers quality and fascinating science and technology content that matters on a daily basis and makes it go viral.

ABOUT US
Sign Up

Copyright © 2015 - 2026 Science Thread. All Rights Reserved.