https://pwn.watch/t/opencode Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:23:59 GMT https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-10-22:The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Status: live, patched https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-20:Anthropic credit restoration still in progress; OpenCode says it will cover them itself if not done this week. Tue, 20 Oct 2026 00:00:00 GMT high Source: https://ctxsec.com/items/opencode-console-provider-key-breach-2026-10 Status: live, partial https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-10-19:Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary. Mon, 19 Oct 2026 00:00:00 GMT critical Source: https://x.com/Pillar_sec/status/2112166888985722937 Status: live, patched https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-19:BleepingComputer and The Hacker News report unauthorized charges up to ~$1,700 and Google Cloud project suspensions; OpenAI says it refunded affected credits. Mon, 19 Oct 2026 00:00:00 GMT high Source: https://thehackernews.com/2026/10/opencode-console-breach-may-have.html Status: live, partial https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-18:Dax says attackers have been 'non stop' attacking OpenCode's systems for 48 hours; systems being hardened. Sun, 18 Oct 2026 00:00:00 GMT high Source: https://x.com/thdxr/status/2111790511409258796 Status: live, partial https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-17T00:30Z:Earliest possible exposure of saved provider keys (per OpenCode's email to affected users). Sat, 17 Oct 2026 00:00:00 GMT high Source: https://thehackernews.com/2026/10/opencode-console-breach-may-have.html Status: live, partial https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-17:OpenCode emails affected users, then announces the breach on X, tied to a 'large scale distillation attack' affecting 1.4% of Console users. Sat, 17 Oct 2026 00:00:00 GMT high Source: https://x.com/opencode/status/2111519637049319818 Status: live, partial https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-17:Dax (OpenCode) clarifies only the hosted Console is affected; keys used locally with the OpenCode app never reach OpenCode. Anthropic and Google revoke/block exposed keys; refunds start. Sat, 17 Oct 2026 00:00:00 GMT high Source: https://x.com/thdxr/status/2111572618340188393 Status: live, partial https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-09-28:OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security. Mon, 28 Sep 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Status: live, patched https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-08-29:Pillar Security privately reports the flaw to Anomaly. Sat, 29 Aug 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Status: live, patched