Two critical RCEs landed this week alongside a meaningful protocol revision in the MCP ecosystem—the kind of week where you're patching in parallel with upgrading. The security items aren't optional reading; if you're running Rails or Nuxt in production, those sections should override your normal triage queue.
mcp-handler 2.0 ships stateless protocol support
mcp-handler@2.0.0 implements the 2026-07-28 MCP spec with a Streamable HTTP transport that requires no session state—no Redis, no sticky sessions, no external coordination layer. Existing Streamable HTTP clients continue working without modification while new clients get the stateless path automatically.
The practical impact is significant for serverless deployments. The previous model assumed durable connections and server-side session tracking, which mapped poorly onto Lambda, Workers, or any ephemeral compute environment. This release makes MCP a first-class citizen on those platforms without workarounds.
Breaking changes to understand before upgrading: HTTP+SSE transport is fully removed. Requests to /sse and /message return 410 Gone. The package also migrates from @modelcontextprotocol/sdk to @modelcontextprotocol/server, and requires Node.js 20+ and zod@^4.
Verdict: Ship if you're targeting modern serverless infrastructure or starting a new MCP server project. Wait if any clients in your system depend on the SSE endpoints—1.x remains the stable path until those clients are migrated.
GPT-5.6 Luna drops 80%, Sol 2.5x faster
Upstream price and performance changes from the model provider are passing through AI Gateway with zero markup. Luna tokens are 80% cheaper. Sol's fast mode is 2.5x faster. Model IDs are unchanged, so your existing routes pick up both changes on the next request.
The Luna reduction isn't incremental—80% is the kind of cost shift that makes previously uneconomical use cases viable. If you've been rate-limiting Luna calls to control spend, that constraint likely needs revisiting. Similarly, if Sol latency was a reason you'd chosen a different model for time-sensitive inference, that calculus has changed.
No code changes are required. The improvement is automatic.
Verdict: Ship immediately for Luna-heavy workloads—run a cost audit against your last 30 days of usage and adjust call volume accordingly. For Sol, if latency has been a pain point, benchmark your current p95 against the new fast mode numbers before assuming the problem is solved elsewhere.
Inkling Small ships on AI Gateway with reasoning
ThinkingMachines' quarter-sized variant of Inkling is now available via AI Gateway at thinkingmachines/inkling-small. It supports controllable thinking effort and native multimodal reasoning, making it directly applicable to agentic coding pipelines and document workflows that previously required a heavier model.
The Zero Data Retention option—configurable per-request—is worth noting for compliance use cases. ZDR without vendor lock-in at the model level is a meaningful differentiator if you're building for regulated environments.
Integration is a model identifier swap in your existing AI SDK calls. No additional setup beyond optionally enabling the ZDR flag.
Verdict: Evaluate before committing. The positioning is compelling—reasoning quality at reduced cost and latency—but benchmark against your actual workload before routing production traffic. Drop it into a shadow evaluation against your current model on real inputs and compare outputs before making the switch.
Rails Active Storage vips RCE requires immediate patching
This one is not a theoretical risk. Default Rails 7.x and 8.x configurations with Active Storage using the vips processor are vulnerable to arbitrary file read and remote code execution when processing untrusted image uploads. Authentication is not required in some exploitation paths.
Patch targets: 7.2.3.2, 8.0.5.1, or 8.1.3.1. After patching Rails, separately verify that libvips is at ≥ 8.13—earlier libvips versions cannot disable unsafe operations regardless of the Rails-level fix, making both updates mandatory rather than optional.
If the upgrade is blocked by dependency constraints, set VIPS_BLOCK_UNTRUSTED=1 in your environment or call Vips.block_untrusted(true) at application boot as a temporary mitigation. WAF rules are not a substitute—the attack surface is in image processing logic, not HTTP layer patterns.
PoC reconstruction becomes trivial once patch diffs are public. That window is short.
Verdict: Ship the patch now. If you can't upgrade today, apply the environment variable mitigation in the next deployment. Do not treat this as a backlog item.
Vercel Sandbox runs isolated agents in single environment
@vercel/sandbox now supports multi-user isolation via createUser() and createGroup(). Multiple agents can run with separate filesystem namespaces in a single sandbox environment, with optional shared workspaces for coordinated work.
The operational story here is the real improvement. Previously, getting meaningful isolation between agents meant separate container instances—spinning up, coordinating, and managing lifecycle for each. This collapses that into a single environment with security boundaries maintained at the process level. Shared directories let agents hand off work without giving up isolation where it matters.
Existing single-user code is unaffected. The new APIs are additive.
Verdict: Evaluate for new multi-agent projects starting now. The model is cleaner than container-per-agent and the isolation primitives look sound. For existing deployments, migration isn't urgent—single-user patterns continue working, so the case for upgrading depends on whether coordination overhead is currently a problem you're solving around.
Nuxt patches eight vulnerabilities including RCE
Nuxt 4.5.1 and 3.21.10 address eight vulnerabilities, two of which are production-critical: a high-severity RCE in server islands and an authorization bypass in route rules that allows cross-user cache disclosure. If your app serves authenticated data through Nuxt, the cache disclosure issue means users can receive other users' data under the right timing conditions.
The patch command is npx nuxt upgrade --dedupe, which handles lockfile refresh. DevTools bumps to 3.3.1 as part of the same upgrade. After patching, purge upstream caches if you were serving authenticated payloads before the patch—cached responses from the vulnerable window may still be in flight.
Platform-level WAF mitigations, including Vercel's, are explicitly not a replacement for the version bump. The RCE surface is in component instantiation logic, which WAFs cannot inspect at the necessary depth.
Verdict: Ship immediately. No workaround exists for the RCE. No production Nuxt deployment handling authenticated data should be running unpatched versions after today.
If this breakdown saved you triage time, Dev Signal publishes exactly this kind of technical rundown every issue—security patches, protocol changes, and model economics, written for engineers who'd rather read one precise source than aggregate five noisy ones. Worth subscribing if your stack touches any of what we covered here.
Top comments (0)