OpenClaw is facing two security incidents at once: a poisoned axios dependency tied to version 3.28 and a confirmed high-risk MEDIA protocol flaw affecting more than 170,000 publicly accessible instances worldwide.