[CRITICAL] OX Security 'Mother of All AI Supply Chains' — MCP STDIO Design Flaw

Systemic RCE-by-design flaw disclosed by OX Security (May 2026) affecting the MCP STDIO transport across the official TypeScript SDK, Python SDK, and reference server implementations — over 150 M combined downloads. The STDIO interface executes arbitrary subprocess commands without validation, exposing 7 000+ public MCP servers.