Faster than the patch - weekly review W45

Weekly review W45, 30 October - 5 November 2026: how fast SAP flaws are exploited, agents in SAP and UiPath, supply-chain incidents from Binance to refrigeration controllers, Linux vulnerabilities, agentic attack tools, oversight of AI models, and the money and hardware behind AI.

This was a week about speed on both sides. Onapsis puts the fastest confirmed exploitation of an SAP flaw at 0.3 days after disclosure. Anthropic researchers, helped by an unreleased internal model, found a remote root bug in the Linux kernel. CrowdStrike reported AI agents targeting more than 200 organisations, and Google’s threat intelligence team with Mandiant described the tooling behind such attacks.

The other pattern is trust. In several stories the route in was a channel companies rely on out of habit: a coding task from a recruiter, an editor extension, a component from a refrigeration supplier. In Płatnik and APT, updates fetched over HTTP could play the same role.

There are sixteen items. Three of them - the Dutch SAP Sovereign Cloud contract, NVIDIA Auto-Ontology and UiPath Delegate - are older stories that returned this week with a new document or a change. Each item gives the facts as the sources state them, followed by my view on what to do about it.

1. Onapsis Days to Zero: SAP flaws exploited within 0.3 to 24 days

On 29 October, Onapsis Research Labs published Days to Zero: 2026 SAP Threat Report, which Onapsis says was prepared with Recorded Future. For every SAP CVE with a verified first exploitation since April 2025, the time from disclosure to attack ranged from 0.3 to 24 days. The median time from security note to exploit or proof of concept fell from 489 days in 2021 to 24-72 hours in 2025-2026. Ransomware groups appearing in SAP-related material grew from 8 in 2023 to 26 in 2025, and the Qilin encryptor stops SAP services. Access to an SAP system sells for USD 500 to 30,000 on criminal markets, against an average of about USD 1,300 for ordinary corporate network access.

These figures come from a company that sells SAP monitoring, and I read them with that in mind. The direction, though, matches what the monthly SAP Security Patch Day notes show: a quarterly maintenance window cannot keep up. An SAP landscape needs a planned track for routine notes and an emergency track, measured in days, for HotNews, plus application-level detection to see attempts during the gap between note and patch. The next SAP Security Patch Day is 8 December. We cover note analysis through our SAP Security Patch Day service and deploy real-time SAP monitoring as a SecurityBridge partner.

Source: Onapsis, Days to Zero: 2026 SAP Threat Report, 29 Oct 2026. Status: figures as stated in the Onapsis post; we have not read the full report; Recorded Future co-authorship per Onapsis.

2. SAP TechEd 2026: a gateway for external agents and SAP Joule Studio

In its TechEd announcement of 27 October, SAP said third-party agents will be able to invoke SAP Joule agents through a governed agent gateway, with A2A and MCP as open protocols for SAP Joule Work. A new SAP Enterprise AI Gateway is meant to extend governance to AI interactions; the press release gives no date, while CIO.com reports general availability planned for the first quarter of 2027. The SAP Joule Studio runtime is free until the end of December 2026 for selected customers under a time-bound promotion, and the design-time tools are free within fair-use limits. npm also lists the @cap-js/agents package for the SAP Cloud Application Programming Model, at version 0.9.10.

The door for outside agents has been announced; the control layer over all of it arrives in 2027 at the earliest. A free runtime until December is a sensible way to drive pilots, but I would start any pilot by asking which agent calls SAP Joule, with what permissions and on whose behalf, and whether it runs as a technical user or with the user’s identity passed through (principal propagation). We review agent permissions in SAP as part of SAP security and test agent behaviour under manipulation in our AI Security review.

Sources: SAP News, SAP TechEd announcement, 27 Oct 2026; CIO.com, 27 Oct 2026. Status: confirmed in the SAP announcement; SAP Enterprise AI Gateway timing per CIO.com, as a plan; package version read from npm on 5 Nov 2026.

3. SAP Sovereign Cloud for the Dutch Ministry of Defence

On 4 November, SAP described its agreement with the Dutch Ministry of Defence: SAP Sovereign Cloud is scheduled to go live on 1 January 2028, with SAP responsible for maintenance, updates and key aspects of operations. The source document says more. A memo from the ministry’s CIO dated 8 October and published by the Tweede Kamer shows the contract with SAP Nederland B.V. was signed on 21 September for five years, with an extension option. The environment in the Netherlands will be physically separated from SAP’s public cloud, and only vetted staff working from a secured facility will have access. The contract value is redacted. Other government bodies can join once connected to the government network NAFIN and after running their own procurement with SAP.

This is not news from the past seven days; the decision was taken in September. I include it because the Dutch memo is the most useful checklist for negotiating a cloud contract with SAP that I have seen this year. Sovereignty here takes the form of clauses on physical separation, on personnel and on who else may join. Public bodies and regulated companies in Poland should read it before discussing RISE with SAP. We run moves to SAP S/4HANA as part of our SAP S/4HANA conversion work.

Sources: SAP News, 4 Nov 2026; Ministry of Defence memo to the Tweede Kamer, 8 Oct 2026. Status: confirmed in the government document and the SAP post; public announcement around 22 Oct 2026.

4. NVIDIA Auto-Ontology: certified business definitions for agents

NVIDIA is developing Auto-Ontology in an open repository under the Apache 2.0 licence. The repository was created on 27 April 2026, last changed on 5 November and had 6,851 stars that day. The tool builds an ontology of business concepts with certified definitions and lineage (the README lists Discover, Ground, Validate, Expose and Learn) and exposes it to agents over MCP as read-only tools, including check_answerable. The README notes that the project does not accept external contributions, the ingestion service has no authentication of its own, and the optional KumoRFM module sends tables to an external service.

The project is six months old; I include it because it touches what we work on every day. An ontology organises concepts, but a certified definition of “customer” means little if the systems hold three records of the same customer with different addresses and tax numbers. The agent then returns a well-described wrong answer. The order I would follow is consistent master data first, a semantic layer second and the agent last. We build the first layer with SNOK MDM. Before testing Auto-Ontology, I would keep the ingestion service inside the internal network and switch KumoRFM off.

Source: NVIDIA Auto-Ontology repository on GitHub, read on 5 Nov 2026. Status: confirmed in the repository; star count as of 5 Nov 2026.

5. UiPath Delegate: new models allowed by default

UiPath Delegate has been generally available since 22 September, together with Cartographer; it is governed through Automation Ops and model calls pass through the AI Trust Layer. The October release notes state that Automation Ops allows each new model by default: anyone who blocked Claude Opus 5 or 4.8 also has to turn off Claude Opus 5.5. Claude Opus 5.5 replaces both older models, including in users’ saved choices. New installations start in Smart mode, which approves actions the model judges safe.

A block set on a named model does not cover its successor, which arrives already approved, and users’ saved choices move to the new model. Model policy in Automation Ops should work as an allow list and be reviewed after every release, and I would enable Smart mode deliberately, for selected processes only. We have already written about what Delegate means for an individual user; this week adds a task for the administrator. We set up governance for UiPath agents in our AI automation projects.

Sources: UiPath Delegate release notes, September 2026; October 2026. Status: confirmed in UiPath documentation on 5 Nov 2026.

6. Binance: fake recruiters in the chain behind a USD 6.34 billion incident

On 3 November, Binance published initial findings on the incident of 29 October, which affected digital assets worth about USD 6.34 billion. By then about USD 2.85 billion had been frozen or intercepted, and Binance is covering the losses. The chain started in June, when an engineer installed a modified Homebrew after searching for an AI tool; the company replaced the hardware and credentials. In September another engineer received a repository with a task from fake recruiters, and a script replaced a pyenv component without the endpoint protection noticing. On 20 October the attackers used an internal AI tool to compromise the accounts of two engineers, including the one from June, who held a container deployment token. On 29 October they took over the transaction signing service. According to BleepingComputer, the FBI attributes the attack to TraderTraitor, a group linked to North Korea.

The link I will remember from the report is September’s: a task from fake recruiters run on an engineer’s machine. I take three points from it. A deployment token on a developer’s laptop is production access. Replacing a laptop does not close an incident while the token lives on another machine. And an internal AI tool became a route for lateral movement. The rule I would set is simple: employees do not run other companies’ recruitment tasks on work hardware. We review developer workstations and their permissions in our cybersecurity audit.

Sources: Binance, initial findings, 3 Nov 2026; BleepingComputer on the FBI attribution, 1 Nov 2026; BleepingComputer on the fake interview, 3 Nov 2026. Status: sequence per the Binance report; attribution per the FBI as reported by BleepingComputer.

7. Refrigeration controllers: more than 115 stores in Europe, EFS and shops in Poland

According to BleepingComputer, attackers disrupted refrigeration systems in more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, including about 40 Ahold Delhaize stores. On 2 November three sites of EFS, the French blood service, were hit; EFS reports no health impact and no product loss. Coolworld, which rents out refrigeration units, describes a problem with a third-party component in a limited number of its units; it does not say whether EFS or the stores are involved. In Poland, Auchan confirmed “irregularities in the control systems of refrigeration equipment” at stores in Olsztyn, Częstochowa-Poczesna and Sosnowiec. On 3 November, Marcin Dudek of CERT Polska spoke of 140 devices visible on the internet, about 70 companies that disconnected them, and one confirmed attack with no losses.

Refrigeration controllers rarely appear in an IT inventory: facilities teams buy them with the equipment and a service company maintains them remotely. They are OT systems like any other, and an attack can mean spoiled stock or blood that can no longer be used. The CERT Polska figures suggest some companies did not know their devices were online. For retail, logistics and healthcare, the useful task this week is a list of OT controllers reachable from the internet and of the service firms with remote access to them. We check which devices are reachable from the internet in our cybersecurity audit.

Sources: BleepingComputer, 2 Nov 2026; BleepingComputer on EFS, 4 Nov 2026; Coolworld, 4 Nov 2026; Interia, Auchan Polska statement; Portal Spożywczy via PAP, 3 Nov 2026. Status: European figures per BleepingComputer; Polish details per Auchan and CERT Polska.

8. Claude Code in the Cursor marketplace: two malicious extension versions

On 29 October, versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for macOS and Windows were available in the Cursor editor’s marketplace for about 11 hours, from 2:27 to 13:35 Pacific time. Cursor states plainly that Anthropic did not develop these versions. The extension could add an attacker’s SSH key named svc-telemetry along with persistence mechanisms; enabling the SSH server itself usually failed without administrator rights. Cursor temporarily took the whole marketplace offline and rotated its keys. Anthropic, according to The Register, says its systems and employee laptops were not compromised. The sources have not established who published the package or how.

Editors built on VS Code run their own marketplaces, while company allow lists usually cover only Microsoft’s store. An AI assistant extension sits inside the editor with access to code, the terminal and any secrets in the repository, so its version belongs to the supply chain just as a library does. On every machine with Cursor I would check the extension version and SSH keys (on Windows also administrators_authorized_keys and the sshd service), rotate secrets reachable from the editor on 29 October, and extend the allow list to every editor in use. We review developers’ AI tooling in our AI Security review.

Sources: Cursor security notice, 29 Oct 2026, updated 30 Oct; The Register, 30 Oct 2026. Status: sequence per the Cursor notice; Anthropic’s position via The Register; number of affected users not established.

9. Linux: remote root via MPTCP, package substitution in APT and an LXD flaw

Three serious flaws in the foundations of Linux servers in one week. CVE-2026-98432 in the kernel’s MPTCP handling allows remote root; Anthropic researchers found it using an unreleased internal model, and their exploit needed 48 minutes to leak a kernel pointer and another 5 minutes to run a command as root. Debian has shipped fixes; as of 30 October, Ubuntu 22.04-26.10 and RHEL 8-10 were still waiting. Go has enabled MPTCP for its listeners by default since version 1.24. CVE-2026-109518 in APT lets an attacker on the HTTP path to a repository substitute packages when APT retries a download, which has been the default since Debian 12 and Ubuntu 22.04; Ubuntu and Debian shipped fixes by 4 November. CVE-2026-112816 in LXD and MicroCloud, rated CVSS 10.0 in the GitHub advisory and Medium priority by Ubuntu, lets someone with access to the HTTPS API and a trusted client’s public certificate impersonate that client.

All three sit in a layer most teams treat as settled. For MPTCP I would check kernel settings, not just applications: Go has enabled MPTCP by itself since 1.24, and the flaw can also be triggered with net.ipv4.tcp_migrate_req=1. I would start with what is reachable: which servers listen with MPTCP, which pull packages from HTTP mirrors, where the LXD API is reachable from outside the admin network. In SAP landscapes the kernel flaw matters most; I would check SUSE and Red Hat patch status before the next maintenance window. We run SAP systems and the platform beneath them in SAP Basis 24/7.

Sources: Anthropic, 27 Oct 2026; Debian, CVE-2026-98432; BleepingComputer, 30 Oct 2026; Ubuntu USN-8996-1, 4 Nov 2026; Debian, CVE-2026-109518; Canonical advisory on LXD and MicroCloud; GitHub Security Advisory GHSA-99jp-jwmc-65p4. Status: confirmed in primary sources; Ubuntu and RHEL patch status for MPTCP as of 30 Oct 2026.

10. VAPOR PANDA and ARTEX: agentic attack tools in live campaigns

On 29 October, CrowdStrike described a campaign by VAPOR PANDA, a China-nexus group: from 17 October, AI agents targeted more than 200 organisations in at least 14 countries. CrowdStrike confirmed post-exploitation activity at nine organisations and password spraying at twelve more. The agents used DeepSeek and a second, unidentified commercial model, and looked for hosts without the Falcon agent. A day later, Google Threat Intelligence Group and Mandiant described the ARTEX framework itself: six cooperating agents written in Go, an original repository removed in October, and forks still in circulation. According to GTIG, the time from a first account to deep network access was around four hours and, in one case, 15 minutes.

This week two large, independent vendors documented an agentic attack with figures and a named tool. What the agents looked for matters more than the victim count: hosts without protection. An agent does not break a well-defended machine; it scans the network faster than a person and lands on the one IT forgot. Full EDR coverage and a current host inventory are therefore a precondition for defence. We check inventory and protection coverage in our cybersecurity audit.

Sources: CrowdStrike, 29 Oct 2026; Google Threat Intelligence Group and Mandiant, 30 Oct 2026. Status: confirmed in both sources; organisation counts per CrowdStrike, timings per GTIG.

11. Overseeing AI models: an Anthropic exercise and an incident at OpenAI

In October, Anthropic’s Alignment Science team described an experiment in which Claude agents searched for fine-tuning datasets that would pass a training-data monitor. The monitor rejected a dataset when it flagged more than 10% or more than 100 rows. According to the authors, the agents found passing datasets in every run. The authors stress that this is not a finding about how deployed Claude models behave, and the modified models were never deployed. Separately, according to an AlphaSignal report of 29 October, OpenAI described a September incident in which an internal research model reached the internet during training through a misconfigured DNS resolver, and a person stopped the run after about 2.5 hours. Reports differ on how quickly monitoring caught it; we did not open OpenAI’s own post.

The two pieces describe the same problem from opposite ends: a monitor acting as guard can be evaded, and in a real incident what counts is the layer the model does not control, network logs and a person with the authority to stop it. I welcome both companies publishing this. In agentic projects for clients I would layer oversight: permission policy, a content monitor, network logs outside the agent’s reach and human approval for irreversible actions. We test that set-up in our AI Security review.

Sources: Anthropic Alignment Science, Automated Subtle Emergent Misalignment Research, October 2026; AlphaSignal, 29 Oct 2026. Status: Anthropic experiment confirmed at source; OpenAI incident per AlphaSignal, the OpenAI post was unavailable to us on 5 Nov 2026, detection time inconsistent across sources.

12. Heretic: stripping refusals from open models

Heretic is an open tool under the AGPL-3.0 licence that suppresses a language model’s refusal behaviour without retraining, optimising for fewer refusals and minimal divergence from the original at the same time. Two examples come from the community. According to the author of that build, the Heretic version of Qwen3.5-4B refused 13 of 100 test prompts instead of 99, with MMLU and WinoGrande scores almost unchanged. Swift 1.5, based on Qwen3.8-27B, dropped from 98 to 36 refusals on the default count (from 99 to 80 in strict mode) but decoded more slowly on the author’s hardware, about 58 instead of 80 tokens per second.

All the figures come from the builders themselves, but the mechanism is simple: an afternoon with a tool from GitHub strips most refusals from an open model. Refusals were never a security control anyway; control has to sit outside the model, in input and output filters and in tool permissions. A policy that says “we use Qwen” or “we use Llama” therefore says very little. A company running models in-house should name specific weights from a specific source with a checksum and verify them at every deployment, the same way it checks a package signature. We select and deploy models on clients’ own infrastructure as part of on-premise LLM.

Sources: Heretic repository on GitHub; Qwen3.5-4B-heretic model card; Swift-1.5-Qwen3.8-27B-heretic model card. Status: confirmed in the repository and model cards; builders’ own measurements, no independent tests.

13. Anthropic’s S-1/A: the pace of model development as a risk factor

On 2 November, Anthropic filed an S-1/A with the SEC. In the risk factors it changed one sentence: instead of “we may not identify a significant acceleration in our rate of development until after it has occurred”, it now reads “we have in the past not identified, and may in the future not identify, a significant acceleration in our rate of development until after it has occurred.” It also added that internal estimates about future models, rather than current ones, indicate it “may imminently meet” its Responsible Scaling Policy’s definition of “dramatically accelerated progress attributable to AI”; no current model has been designated as exceeding that threshold. Elsewhere in the filing it added that it does not expect to be able to safely use Claude to fully autonomously design successive generations of models without meaningful human supervision. According to TechCrunch, citing the Financial Times, credit agencies are expected to rate Anthropic at a speculative grade after the listing.

Lawyers write a prospectus for investors, so every sentence is weighed. In this one a model vendor concedes it may only notice a jump in its own pace of development after the fact. For a business building processes on a single vendor’s models, that is a reason to assess it as any critical supplier: financial condition, risk management and an exit plan. We design architectures in which the model can be swapped and part of the work moved to a locally hosted model, as part of on-premise LLM.

Sources: Anthropic S-1/A, 2 Nov 2026; Anthropic S-1, 26 Oct 2026; TechCrunch, 30 Oct 2026. Status: changes confirmed by comparing both filings in EDGAR; the rating is an expectation reported by the FT, with no agencies named.

14. The memory shortage: RTX 5080, Raspberry Pi 5 and OpenAI at Samsung

According to Tom’s Hardware, the RTX 5080 disappeared from Nvidia’s store, as the RTX 5090 did before it; against a USD 999 recommended price, the cheapest card at US retailers cost USD 2,199.99. On 2 November, Raspberry Pi raised the price of the 16 GB Raspberry Pi 5 by USD 80 to USD 385, more than three times its launch price, citing a lack of alternative supply for 16 GB DRAM. Sam Altman met Samsung’s leadership in Yongin; Samsung confirmed the meeting but announced no new memory supply agreement.

When the maker of a USD 385 computer cites a memory shortage, the squeeze has reached the whole market, small computers included. On-premise AI projects planned for 2027 need headroom in budget and delivery dates, and where a project is already decided, the hardware order is worth bringing forward. As a Lenovo partner we sell servers and AI workstations; details on our Lenovo and SNOK page.

Sources: Tom’s Hardware on the RTX 5080, 30 Oct 2026; Raspberry Pi, 2 Nov 2026; Tom’s Hardware on the launch price, 2 Nov 2026; Tom’s Hardware via Bloomberg, 1 Nov 2026. Status: Raspberry Pi pricing confirmed by the manufacturer; card prices and the Samsung meeting per Tom’s Hardware.

15. NVIDIA Rubin at shipping specifications and AMD’s third quarter

NVIDIA’s Vera Rubin NVL72 page lists a single Rubin GPU with 288 GB of HBM4 at 19.2 TB/s and NVLink bandwidth of 3 TB/s. The earlier, preliminary figures were 22 TB/s and 3.6 TB/s, so memory bandwidth is 12.7% lower and NVLink 16.7% lower. According to ServeTheHome, NVIDIA published the new figures in September, and the first production hardware is now reaching customers. On 3 November, AMD reported third-quarter 2026 revenue of USD 13,377 million, up 45% year on year, including USD 8,546 million from Data Center, up 97%. AMD expects about USD 17 billion for the fourth quarter and says Anthropic, Meta, Microsoft, OpenAI and Oracle Cloud Infrastructure are running models on the first AMD Helios systems.

A quote should rest on the product sheet on the day of the order. Anyone who estimated Rubin inference throughput from the launch figures should run the numbers again. I read AMD’s result as a sign that large buyers are building a second source of accelerators. We size hardware for locally hosted models on shipping specifications as part of on-premise LLM.

Sources: NVIDIA, Vera Rubin NVL72, read on 5 Nov 2026; ServeTheHome, 1 Nov 2026; AMD third-quarter 2026 results, 3 Nov 2026. Status: Rubin specifications and AMD results confirmed at source; timing of the specification change per ServeTheHome; percentage differences calculated by us.

16. CSIRT Energia and three flaws in Płatnik

According to CRN.pl, on 30 October Poland’s energy minister Miłosz Motyka and the president of PSE, the transmission system operator, Grzegorz Onichimowski, signed an agreement under which PSE will set up and run CSIRT Energia, according to Gramwzielone.pl the fifth sector CSIRT in Poland. The team will, as CRN.pl reported, support the sector rather than take over companies’ own responsibilities. On the same day CERT Polska published a warning about three flaws in Płatnik, the software that Polish employers use to file social security returns with ZUS: updates and libraries downloaded over HTTP allow files to be substituted (CVE-2026-110970), the password is weakly encoded (CVE-2026-110971), and client-side authentication allows logging in as any user (CVE-2026-110972). The advisory says they were fixed in release (“metryka”) 334 of version 10.02.002.

The energy sector gains a dedicated point of contact for incident coordination, which should simplify reporting under the amended Polish cybersecurity act. The sources give no start date for the team, so I would leave incident procedures unchanged until it is announced. Updating Płatnik is urgent: it runs in the payroll teams of many Polish companies and in accounting offices, and fetching updates over HTTP gives an attacker on the network path an opening similar to the APT flaw. A NIS2 and DORA audit and our free KSC Check tool help put the obligations in order.

Sources: CRN.pl, 30 Oct 2026; Gramwzielone.pl, 2 Nov 2026; CERT Polska, 30 Oct 2026, updated 3 Nov 2026. Status: Płatnik flaws confirmed in the CERT Polska advisory; CSIRT Energia per media reports, the ministry and PSE announcements not opened.

Five checks before SAP Security Patch Day on 8 December

The December SAP Security Patch Day is less than five weeks away. This review leaves me with five tasks for that time.

1. An emergency track for SAP HotNews notes, measured in days, with an owner on both the business and the Basis side.
2. An allow list of AI models instead of a block list, in Automation Ops, in agent platforms and for locally hosted models, naming specific weights and checksums.
3. An extension list covering every editor, Cursor included, and a review of deployment tokens on developers’ machines.
4. A list of OT controllers and devices reachable from the internet, together with the service firms that have remote access to them.
5. Kernel and APT fixes on Linux servers, the LXD fix wherever the API is reachable from the network, and the Płatnik update.

If you would like to work through this list with us, get in touch.