Wiremod drops Player:ConCommand to stop command injection
Astralcircle's merged Wiremod PR replaces Player:ConCommand with WireLib.SetConvar everywhere except E2's concmd().
Shortly before, in #developer-talk, Redox showed that tools passing strings to ConCommand let players inject console commands, with Wiremod's textscreen as an example, and called it "exploit week".