OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

THE NEWSROOM - WHAT HAPPENED WHILE YOU SLEPT

Welcome back to THE NEWSROOM, where we track what happened while you slept. Tonight we bypass the standard cycle for a special security edition, because the ground under the modern web moved in the la

While you were sleeping, somebody found a way to run code on a PHP server without ever logging in. The PHP Group shipped two emergency patches, CVE-2026-109618 and CVE-2026-109619, both rated nine poi

Over in the JavaScript world, the same night produced ten CVEs in Node.js. Four high severity, three medium, three low. The one that matters most is a bug in the Brotli decoder that leads to remote co

Then there is the one that does not even need a server to exploit. Eight intermediate certificates from the eMudhra certificate authority were compromised, and when an intermediate is compromised, som

And finally, for our Clock Out, we look at the doctrine that quietly stopped working. Remember patch Tuesday? The monthly window, the change freeze, the careful rollout on a Wednesday morning. It all

While you were sleeping, GitLab patched a self-managed flaw rated ten out of ten, CVE-2026-110264, unauthenticated remote code execution, running all the way through twelve years of releases. GitLab.c

Understanding Runtime Application Self-Protection, or RASP, in the context of tonight's exploits is like putting a security guard inside the execution engine rather than leaving one standing at the fr

So here is the question for the morning. Did you upgrade and patch, or did you go to bed and hope? Because getting this wrong is not a bad week. It is an attacker running code on your server without l