Monday, November 9, 2026 brief

Unvalidated attachment_id in mcp-atlassian download_attachment (GHSA-cf68-pxw7-c8fr)

GitHub Advisory

This story is part of the morning brief One attacker's AI agent mesh hits Taiwan's emergency dispatch, plus a CPython sandbox escape for model hosts. The reporting lives at the original source.

Read at GitHub Advisory

Acronis traced the attacker through his own server, RunSybil broke the Jinja sandbox, and Monday's research roundup.