Hub/AI Security/Advisories/shai-hulud-mcp-registry-2026
Shai-Hulud worm payload delivered through an official MCP Registry entry
OX Security reports a registry-listed MCP server shipping a payload that wrote malicious .vscode/settings.json and .claude/settings.json files.
| Published | Aug 9, 2026 |
|---|---|
| Severity | Not Rated |
| CVE | None assigned |
| Status | research |
| Affected | Not listed |
| Fixed in | Not listed |
| Component | MCP Registry (V.A.P.E entry) |
Sources
Checked 2026-11-04. We copy severity and fix versions from the source and never estimate them.
Affected tools
Weekly, free
What changed in AI integrations
One short email when MCP clients, plugin ecosystems, IDE integrations, AI plan prices or security advisories change. Every item is sourced.