Daily CVE highlight, 26 October 2026: patch the agent sandbox today, check one ArcGIS setting, audit your namespaces

Twenty-eight entries in today's feed looked critical. Four deserve your time, and they are not the four with the highest scores. Here is the order to act in, the one fact each score leaves out, and where the full note and PDF are.

1. Today: OpenHands agent sandbox, CVE-2026-112346

Before 1.52.0 the sandbox agent server listens on every interface with no key, so anyone who can reach the port gets a root shell in the sandbox, the mounted workspace and the secrets store. The score (9.8) is accurate and the unsafe state is the default. What it does not say: this is root in the sandbox, not on the host. Your damage is whatever you mounted, so start by asking what the agent can see. First move: find the published port (docker ps), take it off the network, upgrade.

• OpenHands note: what it gives an attacker and what to check →Root in the sandbox is not root on the host, and why the difference decides your response.
• PDF action plan →Procedure, hardening, hunting and a definition of done.

2. Today if it is public: ArcGIS Server SQL injection, CVE-2026-10757

The 9.8 assumes an anonymous attacker. Esri says the attacker needs privileges to reach the service, and anonymous access follows only for services set to the non-default public configuration. So one server is an emergency and the next is not, on the same version. First move: list your services and their access setting, patch the public ones first. Patches exist for 12.1, 12.0, 11.5, 11.3 and 11.1; older versions have none and need an upgrade.

• ArcGIS note: what the score assumes and what the vendor says →How to tell which of your servers is the emergency.
• PDF action plan →Classify, patch, stopgaps and what to look for in logs.

3. This week, if clusters are shared: consul-k8s, CVE-2026-110720

Not an internet bug: the attacker starts inside your cluster, with the right to create a ServiceAccount in another namespace and a route to the Consul API, on a deployment with system ACL management on. In a shared cluster that is exactly the foothold a compromised pod provides. First move: count who can create ServiceAccounts outside their own namespace, restrict who can reach the Consul API, then upgrade to 1.8.18 or 2.1.0 and re-read your binding rules.

• Consul-k8s note: a namespace is not an identity boundary →Who is exposed, who is not, and how to audit your binding rules.
• PDF action plan →Audit procedure, interim controls and a definition of done.

4. This week, if you have the devices: boneIO Black, 11 CVEs from CERT Polska

Authentication is off by default and the API is open on every interface. That one default chains into plaintext credentials, a Node-RED that runs commands, and root through passwordless sudo. All eleven are fixed in 1.6.0. Two things people miss: devices before 1.2.0 cannot be upgraded in place and must be re-flashed, and upgraded devices keep their old MQTT passwords until you change them. Our feed showed 0.0 for the headline CVE, which means unscored. CERT-PL's own score is 8.7.

• CERT Polska advisory →The primary source: all eleven CVEs, the fixes and the recommended actions.

What all four have in common

None of them is a clever bug. A service shipped open, an identity boundary that was never checked, a setting that changes who counts as the attacker, a default nobody had to change. The questions that sort them are the same every day: who can reach this, what does it do when nobody configured it, and what can the account behind it touch? A score answers none of those.

Fifteen minutes this morning

• Run docker ps and look for 0.0.0.0 mappings on anything an agent starts.
• List your ArcGIS services and mark which are public.
• Count who can create ServiceAccounts outside their own namespace.
• Search your network for boneIO devices, and for anything else that lets you in without a login.
• Check the PHP item below if you run PHP.

Not picked, but worth a minute

• PHP2Shell, CVE-2026-109618 and CVE-2026-109619: CISA added both to its Known Exploited Vulnerabilities catalog today, due 29 October. If you run PHP, this moved up.
• TOTOLINK A950RG, CVE-2026-116504, 116506 and 116508: public exploits are noted, but we found no vendor fix or advisory, only third-party write-ups. If you have one, take its management interface off untrusted networks.

• PHP2Shell: what to do this week →Updated today for the KEV listing. Which versions fix it and how to check a server without being fooled by your package manager.
• Wasmtime sandbox escapes →The fixed version depends on your release line. Also from this week.

Keep reading

• A new CVE, an agent, and four questions →What to ask an AI agent about a CVE, and how to read the answer without being misled by it.
• Teach your agent to say likely, not is →Why an inferred link must never read like a published one.
• Lattice →A public cyber knowledge graph for AI agents.
• Day-0 Watch →A monthly briefing for teams without a security specialist.
• The IT check →Where a small estate stands before the next CVE lands.

What we do not know

• Whether any of the four is being exploited. None of the records says so; check CISA's catalog.
• Whether public exploit code appears for the three vendor-patched ones. We have not read any.