Two still days on the tracked stack — nothing new has cleared the bar since the 17th, and the pip and npm advisory feeds have been quiet through. The reason to open this one is a hole from earlier in the week that's still open, and that these digests hadn't flagged: LangBot, the open-source LLM chatbot platform, carries an authenticated remote-code-execution flaw in its MCP server configuration (8.8), and unlike everything in the last two mornings, it has no fixed release. Any account that can log in can run commands on the host — so until a patch ships, access control is the whole defence.

Worth your morning

LangBot — the fix hasn't shipped. CVE-2026-54449 (8.8) lets a logged-in user register a STDIO-transport MCP server whose command LangBot runs as a subprocess without validation, so any authenticated account executes arbitrary commands with the service's privileges — the scope for data exfiltration or a foothold on the host. Every version through 4.10.5 is affected and there is no patched release as of this morning, which makes the mitigation the entire defence: treat authentication as the trust boundary. Keep the admin UI off untrusted networks, put it behind your reverse proxy or VPN, tighten who holds an account, and audit the configured MCP servers for entries you didn't add. Then watch the project's releases for the fix.

Otherwise clean: the Prompty and vLLM clusters from earlier in the week are in the last two digests, and nothing has landed on the npm, NuGet, .NET, Azure, or Angular side since.