Key under the doormat - weekly review W46

Weekly review W46, 6-12 November 2026: four SAP notes rated 10.0, flaws in OpenSSH and Outlook, device code phishing and passwords in a coding agent’s settings file, alongside agents in UiPath and in airline booking, new AI models and the resignation of Nvidia’s chief executive.

This week four SAP notes carry a CVSS score of 10.0, and they concern components that handle network traffic. An OpenSSH flaw opens, in certain configurations, to a very long password. A coding agent sometimes saves passwords in a settings file that users then add to public repositories. In device code phishing, victims type a code into Microsoft’s genuine sign-in page themselves. In several of this week’s stories, access was left where anyone could look, hence the title.

There are thirteen topics, each with the facts as the sources state them and my comment. Some events are dated 5 November, but their consequences played out this week. The OWASP SAP Pentest Playbook is not new: it has been developed since May 2025 and is worth knowing when planning a test.

1. SAP Security Patch Day: 42 items and four notes rated 10.0

On 10 November SAP published 42 items: 35 new security notes, 4 GitHub advisories and 3 updates to earlier notes. Nine are rated critical. Four carry a CVSS score of 10.0: 3778530 for ICM in AS ABAP, 3778556 for SAP Web Dispatcher, 3798345 for SAP Gateway, and 3849308 for the SAML2 Service Provider in AS ABAP and ABAP Platform. A maximum CVSS score means an attack over the network, with no privileges and no user interaction.

What the four have in common is the entry layer: the components that handle HTTP, RFC and federated sign-in. They can be reachable from partner networks and sometimes from the internet. This month I would schedule a kernel update and check which ICM, Web Dispatcher and Gateway instances can be reached from outside the internal network. SAP does not say whether any of these flaws is being exploited. The next SAP Security Patch Day is on 8 December. We review the notes every month in our SAP Security Patch Day service.

Source: SAP Security Notes, November 2026. Status: confirmed on the SAP page on 12 November 2026.

2. The OWASP SAP Pentest Playbook: an open catalogue of SAP testing techniques

Within the OWASP Core Business Application Security project, the SAP Pentest Playbook collects penetration testing techniques for SAP systems under a CC BY 4.0 licence. The repository is maintained by SecuritySilverbacks. It dates from 10 May 2025, has more than 300 commits, and was last changed on 7 November. OWASP lists the CBAS project as an Incubator. Among the sponsors named in the repository is SecurityBridge, with which we are partners.

It is a community effort with no standing as an OWASP standard or recommendation. It is useful as a shared vocabulary, though: the board and the Basis team can compare the scope of a commissioned test with a list of techniques anyone can read. Before the next SAP pentest I would ask the supplier which techniques from the list it covers, which it leaves out, and why. We run these tests in our SAP penetration testing service.

Sources: GitHub, SecuritySilverbacks/sap-pentest-playbook; OWASP Core Business Application Security. Status: confirmed in the repository and on the OWASP page on 12 November 2026.

3. UiPath as a launch partner for Gemini for healthcare

UiPath announced on 10 November that it is a launch partner for Google Cloud’s Gemini for healthcare. Through the UiPath MCP Server, Gemini can start an automation, check its progress or hand a task to a UiPath agent, with the platform’s existing access controls and audit still in force. The integration is in preview for joint UiPath and Google Cloud customers. The announcement gives no general availability date, pricing or geographic scope.

The split of roles matters. The model holds the conversation and decides what to do; execution goes through a platform with permissions and audit. With patient data, that trail is especially valuable. Anyone planning this in Poland should wait for word on availability in the European Union and on data processing terms. The pattern itself, a model calling a governed automation through MCP, is worth assessing on your own process now.

Source: UiPath announcement, 10 November 2026. Status: confirmed in the vendor’s announcement; geographic scope not established.

4. United will not let third-party AI agents complete bookings

According to The Verge, citing the Wall Street Journal, United Airlines will not allow third-party AI assistants to complete a ticket booking on a user’s behalf. Agents can still search for and display flights. The airline cites customer data protection, the risk of unintended purchases and federal disclosure requirements in ticket sales. According to the WSJ, United’s chief executive, Scott Kirby, said he did not want another middleman. The airline has left room to revisit the decision.

Companies planning purchasing or customer service agents should expect that an external agent may find the door closed by the other side, for compliance and privacy reasons, but also because that side does not want to give up the customer relationship. Connecting an agent to someone else’s system should go through an agreed, authenticated integration.

Source: The Verge, 11 November 2026. Status: media report, single source; we did not open the WSJ article or a statement from United.

5. SSHole: bypassing OpenSSH password login on musl

On 5 November OpenSSH released version 10.6p2, which works around CVE-2026-123158, known as SSHole, on the sshd side. The flaw affects sshd on Linux with the musl library, with PAM disabled and password authentication on. For some accounts with an asterisk in the password field, any password longer than 256 bytes and up to 1,024 then works, provided another local account has a valid hash. NVD names Alpine as an example platform, and Alpine ships with these settings by default. CISA added the flaw to its catalogue of known exploited vulnerabilities on 9 November, and, according to Help Net Security, Previdian recorded the first attempt less than nine hours after the CVE was published.

So I would start with an inventory: which images and devices run OpenSSH on musl with password login enabled. Until they are on 10.6p2, I would set PasswordAuthentication no and restart sshd as a stopgap, once key-based login is confirmed to work. Dropbear and systems with glibc or PAM are not affected. Any successful login to an account with an asterisk in the password field should be treated as an incident.

Sources: OpenSSH 10.6p2 release notes; musl mailing list, 6 November 2026; CISA KEV. Status: confirmed.

6. Microsoft Patch Tuesday: one exploited flaw, in Outlook

Microsoft’s November release, out on 10 November, fixed 1,093 vulnerabilities in its own products, according to Tenable. Adding 142 flaws in the Chromium-based Edge browser gives 1,235, which is why reports quote two different totals. The only flaw marked as exploited is CVE-2026-124194 in Outlook: opening a crafted message file leaks the NTLMv2 hash without the usual warning about external content. Microsoft rates it Moderate, CVSS 6.5. CISA has added it to the KEV catalogue with a deadline of 24 November. According to Tenable, Microsoft marks remote code execution flaws in AD DS, Exchange Server and Schannel (CVSS 8.8, 8.8 and 8.1) as more likely to be exploited.

The 6.5 score understates the risk, because the flaw is already in use. The fix ships through Microsoft 365 Apps, not the Windows cumulative update, so a team that patches only servers and the operating system will miss it. Anyone rolling out SAP notes and Microsoft fixes in the same week has two separate channels to check.

Sources: Tenable, 10 November 2026; BleepingComputer, 10 November 2026; CISA KEV. Status: partly confirmed - figures and CVEs from analysts (Tenable, BleepingComputer, Qualys, ZDI) and the CISA catalogue; we did not open Microsoft’s Security Update Guide.

7. Device code phishing dressed up as AI events

Push Security has described a campaign of fake event invitations using the OpenAI and SpaceX brands, with prizes such as three months of ChatGPT Pro. An Anthropic-branded variant was already inactive at the time of the analysis. The pages sent victims either to Kali365, a device code phishing platform for Microsoft Entra accounts, or to VoidProxy, which intercepts Google sessions as an adversary-in-the-middle. According to BleepingComputer, a stolen Entra token opens the applications connected through single sign-on, including Microsoft 365, Salesforce, Atlassian and SAP.

In this scheme the user types a code into Microsoft’s real page and authorises the attacker’s device themselves, so a correct address bar offers no protection. A simple rule helps: never enter a device code unless you started the sign-in on another device yourself. In Microsoft Entra, restricting the device code flow through Conditional Access where it is not needed helps too.

Sources: Push Security, 5 November 2026; BleepingComputer, 5 November 2026. Status: confirmed; number of victims unknown.

8. Claude Code: passwords in the “don’t ask again” file

According to The Hacker News, Apiiro examined 104,185 copies of .claude/settings.local.json in public repositories. This is the file where Claude Code stores commands approved with “Yes, and don’t ask again”, sometimes in full, including a password typed into the command. Secrets turned up in 1,122 copies, about 1.1 per cent, 1,379 distinct secrets in all, among them 379 database passwords, 43 sets of SSH credentials, 42 GitHub, GitLab and npm tokens and 23 AWS keys. Neither of the two popular scanners, gitleaks and TruffleHog, flagged the secrets in 215 of these files. According to The Hacker News, Anthropic has not commented.

Users add the file to their repositories. Claude Code puts it in the user’s global gitignore, but not in the project’s .gitignore. I would treat coding agents’ directories such as .claude/, .cursor/ and .gemini/ like .env files: add them to an organisation-wide .gitignore, scan repository history, and rotate any password found before removing it from the history. We cover working practices for coding agents in our AI Security work.

Source: The Hacker News, 7 November 2026, reporting on Apiiro’s research. Status: media report; we could not read Apiiro’s original report.

9. OpenAI GPT-6 Cyber for a small circle of researchers

On 5 November OpenAI announced GPT-6 Cyber, available to selected, approved customers of its Daybreak Red programme. OpenAI says the model produced working privilege escalation exploits for 948 vulnerabilities in the Linux kernel and found 81 previously unknown high-severity flaws in Firefox. On ExploitGym, a benchmark internal to OpenAI, GPT-6 Cyber scored 48.5 per cent against 32.1 per cent for GPT-5.6 Cyber, according to the vendor. Mozilla’s advisory MFSA 2026-118 of 27 October, which we checked, credits OpenAI with 41 entries; the figure of 81 may span other advisories too.

These figures come from the vendor, and without independent verification I read them as claims. Even so, I expect vulnerability reports in popular software to keep growing; Mozilla’s advisories and OpenSSH’s release notes already credit AI-assisted reports. If so, I would make room in next year’s budget for a shorter patch cycle.

Sources: BleepingComputer, 6 November 2026; TechCrunch, 5 November 2026; Mozilla MFSA 2026-118. Status: figures according to OpenAI, as reported by the media; we could not read OpenAI’s announcement.

10. A mobile agent sees something different from a person

“When Agents See Differently”, an arXiv paper revised on 6 November, describes the gap between what a mobile agent sees on screen and what a person sees. The researchers ran 546 tasks across 13 apps, 5 agent frameworks and 3 models. The average rate at which the agent was misled, picking the control chosen by the attacker, was 77.4 per cent in static evaluation and 67.2 per cent in dynamic evaluation, at app level. It is a preprint without peer review.

An agent that acts on what it sees on screen can be steered where a person would not go. The preprint has not been peer reviewed, so I would read the figures as a warning sign. Even so, in automations that rely on screen recognition, I would require human confirmation for irreversible actions.

Source: arXiv 2609.16732. Status: paper opened, preprint.

11. Claude Fable 5.2 and Mythos 5.2: 20 per cent less per token

On 9 November Anthropic released Claude Fable 5.2 and Claude Mythos 5.2. They share a base model with different safeguards: Fable is open to all customers, Mythos only to verified organisations in its cyber security and life sciences programmes. Compared with version 5.1, the price of both fell from USD 10 to USD 8 per million input tokens and from USD 50 to USD 40 per million output tokens. Anthropic says both models voice suspicion that they are being evaluated more often than any of its recent models. According to the documentation, they require 30-day data retention and are not available under zero data retention without Anthropic’s approval.

For deployments, retention matters most: a customer under NIS2 or DORA, or with personal data in prompts, should check this before switching models. If a model more often voices the suspicion that it is being evaluated, acceptance tests for an agent should run in conditions as close to production as possible. A lower price per token does not settle the cost of a task, which depends on the reasoning setting.

Sources: Anthropic, 9 November 2026; Claude Fable 5.2 documentation; TechCrunch, 9 November 2026. Status: confirmed by the vendor.

12. Nvidia: Jensen Huang steps down

On 11 November Nvidia’s board accepted Jensen Huang’s resignation as president, chief executive and director, with immediate effect. Huang had led the company for 33 years, since he co-founded it in 1993. Colette Kress, chief financial officer since 2013, is acting CEO, and Harvey C. Jones has become chair of the board. The company is looking for a permanent chief executive among internal and external candidates. The SEC filing gives no reason for the resignation. The decision followed two weeks of media reports about the chief executive. The latest, published by The New York Times on 11 November, concerned a relationship with a senior executive who reported to him. The board had opened an independent investigation on 8 November. The company does not link these reports to the resignation. According to TechCrunch, the shares fell about 8 per cent in after-hours trading on 11 November. Nvidia reports results for the third quarter of fiscal 2027 on 17 November.

For companies buying AI infrastructure next year, what counts is that a key supplier of AI accelerators has interim leadership and is still looking for a permanent chief executive. For purchases planned for 2027, it is worth having a fallback option.

Sources: Nvidia, Form 8-K, 11 November 2026; Nvidia press release, 12 November 2026. Status: resignation, succession and results date confirmed in company filings; reports on the chief executive, the investigation and the share price from the media (TechCrunch, Euronews, Al Jazeera); we did not open The New York Times.

13. Poland’s Ministry of Digital Affairs and Microsoft agree on cyber resilience

According to CRN.pl and the Polish Press Agency, Poland’s Ministry of Digital Affairs and Microsoft have agreed to cooperate on the cyber security of public administration, critical infrastructure and essential state services. CRN.pl names secretary of state Paweł Olszewski and Microsoft vice-president Mike Yeh as the parties. The scope covers threat information sharing, finding vulnerabilities, protecting legacy systems, fast restoration of services and the use of AI by defence teams. According to PAP, the agreement complements Microsoft’s February 2025 arrangement with the Ministry of National Defence.

The media reports suggest no new legal obligations for companies. They do show where the administration sees its priorities: legacy systems and service continuity. Assessing the impact on organisations covered by Poland’s National Cybersecurity System Act (KSC) and NIS2 will need the ministry’s own announcement, which we have not yet found.

Sources: CRN.pl, 10 November 2026; XYZ.pl, reporting PAP, 10 November 2026. Status: media reports; we found no ministry announcement, and the date and form of the document have not been established.

Five checks before 8 December

Fewer than four weeks remain before December’s SAP Security Patch Day. I have picked five places from this review where access may have been left under the doormat.

1. Which ICM, SAP Web Dispatcher and SAP Gateway instances are reachable from outside the internal network, and whether a kernel update is planned.
2. Which container images and devices run OpenSSH on musl with password login.
3. Whether the Outlook fix from the Microsoft 365 Apps channel has been checked separately from Windows updates.
4. Who actually needs the device code flow in Microsoft Entra.
5. Whether .claude/, .cursor/ and .gemini/ are in .gitignore and whether repository history has been scanned.

If you would like to work through this list with us, get in touch.