Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-01 · high
The bug lives in server code, not any single app, so builders who copied the SDK's default pattern pass the exposure to their own users.
Why now: This matters now because the shared-instance setup it flags is already common in production, not a rare misconfiguration.
CVE-2026-25536 hit the SDK when a single McpServer instance served multiple clients, per Practical DevSecOps. The bug scores 7.1 on CVSS and covers SDK versions 1.10.0 through 1.25.3.
Reusing one server instance across multiple clients isn't a fringe setup. It's already the default for shared and remote MCP deployments running in production.
That makes this a framework bug, not a downstream-app bug. Any MCP server built on that SDK range exposes its own users to a default its builder didn't choose. The users of that server pay for a decision they never made.
Upgrading past 1.25.3 stops the SDK's bug. It doesn't check whether your own server still assumes one instance per client somewhere else in the stack, so the audit is on you.
A CVSS score on a dependency says the library stopped being the guaranteed cause. It doesn't say a specific deployment stopped leaking. Patched isn't the same as safe.
Each link below shares sources, entities, or timing with this story.
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
The Model Context Protocol's 2026-07-28 revision is the biggest change since the protocol existed. The core is now stateless request/response instead of a bidirectional stateful session. Authorization aligns with OAuth 2.1 and OpenID Connect. MCP Apps and Tasks moved under a v...
A single architectural decision, replicated across Python, TypeScript, Java, and Rust, sitting at the center of the protocol most agent builders now run. OX Security's research team disclosed a critical vulnerability in the official Model Context Protocol SDKs that enables arb...
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
The most important security research this week. Check Point demonstrated three attack vectors in Claude Code exploiting project configuration files in untrusted repositories: (1) Hooks RCE (CVE-2025-59536, CVSS 8.7) — malicious hooks in .claude/settings.json execute shell comm...
One Claude Code release fixed two independent permission-check bypasses on the same day. That's the story. Version 2.1.221, shipped August 4, patches a Bash tool bypass where zsh could execute hidden commands embedded inside [[ ]] regex conditionals. The approval prompt never...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.