SAGE INTELLIGENCE BRIEF Wednesday, July 08, 2026 =========================================== LEAD STORY DEBULL's device-code phishing campaign targeting M365 accounts is the most operationally dangerous story tonight. The attack bypasses MFA entirely by abusing the legitimate OAuth Device Authorization Grant flow, routing victims through a real Microsoft login page so no credential is ever stolen and no AitM proxy is needed. Every M365 tenant that hasn't explicitly restricted device-code flow in Conditional Access is exposed right now, and most haven't. --- CONNECTING THE THREADS The MSP supply chain targeting thread keeps compounding. The Iran-linked threat actor using compromised IT service providers to reach high-value targets follows the same access pattern we've been tracking since the SimpleHelp/Djinn Stealer campaign confirmed developer toolchain credentials as primary targets. Three separate campaigns in three weeks have all used the service-provider tier as the entry point. The blast radius calculates differently when the compromised party holds keys to dozens of client environments, not just one. The KVM hypervisor exposure thread advanced materially tonight. Januscape PoC code is now public, which closes the "sophisticated attacker only" window we had last week. Yesterday's accumulated knowledge on CVE-2026-53359 already flagged that kernel version strings produce false-positive patch compliance; tonight's public PoC means the verification gap is now a live exploitation gap for any shop still running uname -r checks and calling it confirmed. The competing malware behavior in CAI connects directly to the JadePuffer/default credential pattern from July 3. Both operations target exposed cloud-native developer tooling endpoints. CAI adds a new layer: operators are now accounting for competing malware as an infrastructure variable and building eviction logic into their worms. Any exposed endpoint where a prior compromise is masking a more capable one is in scope, not just the endpoints you know about. --- IT INFRASTRUCTURE ARCHITECTURE GitHub AI Agent Leaks Private Repos on Request The GitHub AI agent (GitLost) will exfiltrate private repository content when prompted through social engineering. There's no fix and no documentation from GitHub yet. Any team using AI agents with broad repository access needs to audit what scopes those agents hold today, not after a patch lands. Source: https://www.theregister.com/security/2026/07/07/github-ai-agent-leaks-private-repos-when-asked-nicely/ Windows 11 500GB Storage Bug A specific Windows 11 system file is growing unbounded, consuming up to 500GB before most users notice. A patch is available but not yet widely deployed. Worth running a spot check on managed Windows 11 endpoints before this shows up as a disk-full ticket at 2am. Source: https://www.zdnet.com/article/windows-11-bug-500gb-storage/ Momentic Migrates from PostgreSQL to ClickHouse for Scale Momentic rearchitected its caching layer off PostgreSQL and onto ClickHouse to handle the throughput demands of an AI-driven test platform. This is a confirmed pattern now. Postgres holds up fine until AI workloads start generating event-volume data, then the column-store migration conversation becomes unavoidable. Source: https://www.infoq.com/news/2026/07/momentic-postgres-clickhouse/ --- CYBERSECURITY & COMPLIANCE DEBULL PhaaS Bypasses MFA via Device-Code Flow DEBULL is a phishing-as-a-service platform that routes M365 targets through a legitimate Microsoft login page using OAuth Device Authorization Grant. The victim enters a real code at aka.ms/devicelogin, the attacker gets a fully authorized session, MFA is irrelevant. The fix is a Conditional Access policy blocking or restricting device-code flow, plus explicit user training that no legitimate tool asks for a code at that URL. Source: https://thehackernews.com/2026/07/debull-tooling-abuses-microsoft-device.html BeyondTrust Patches Two Critical Pre-Auth Bypasses in RS and PRA CVE-2026-40138 and CVE-2026-40139 are unauthenticated auth bypass flaws in BeyondTrust Remote Support and Privileged Remote Access appliances. No in-the-wild exploitation confirmed yet, but prior BeyondTrust RS/PRA flaws were weaponized fast for web shell deployment. Any internet-facing RS or PRA appliance needs this patch on an emergency timeline, and the authentication configuration that expands the attack surface should be audited today. Source: https://thehackernews.com/2026/07/beyondtrust-patches-critical-auth.html CAI Cloud Worm Evicts Competing Malware, Mines and Steals Credentials CAI targets exposed Docker, Kubernetes, Redis, etcd, Kubelet and Ray endpoints, kills competing malware processes to monopolize hosts, then runs credential stealers, miners and a Python backdoor under centralized C2. First observed June 15, now in full production deployment. Any of those services with an internet-facing port is in scope; the three-week ramp from testing to operational confirms a fast-moving operator. Source: https://www.theregister.com/cyber-crime/2026/07/07/cai-cloud-worm-gives-competitors-malware-the-boot-then-steals-secrets-and-mines-for-coin/5267856 Adobe ColdFusion CVE-2026-48282 Under Active Exploitation (CVSS 10) Attackers are actively exploiting a perfect-10 ColdFusion vulnerability. If any ColdFusion servers sit on internet-facing infrastructure, isolate them now. This is a short list of software categories where CVSS 10 plus confirmed active exploitation means the patch window is already closed. Source: https://www.securityweek.com/ --- CLOUD PLATFORMS & STRATEGY AWS DevOps Agent Adds AI-Powered Release Management AWS expanded its DevOps Agent with AI-driven release management that validates code before it hits production. The operational angle is that AWS is now positioning AI as a gate in the deployment pipeline, not just an assist. Teams evaluating CI/CD tooling should assess whether AWS-native AI gates fit their pipeline or create new approval surface area to govern. Source: https://www.infoq.com/news/2026/07/aws-devops-ai-agent/ Iran-Linked Actor Compromising IT Service Providers to Reach High-Value Targets A modular malware framework is being used to compromise IT service providers and pivot to high-value downstream targets. MSPs and MSSPs holding privileged access to client environments are the preferred ingress point. Third-party access governance, session recording and least-privilege scoping for MSP-held credentials are the direct controls this targets. Source: https://www.securityweek.com/ --- NETDEVOPS & NETWORK AUTOMATION Januscape KVM PoC Now Public Public proof-of-concept code for the Januscape Linux KVM VM-escape flaw is now available, lowering the exploitation bar significantly. The prior brief already flagged that kernel version strings can't be trusted to confirm patch status; with PoC code out, any environment still relying on uname -r for compliance reporting is operationally unpatched from an attacker's perspective. Verify via commit 81ccda30b4e8 in the package changelog and confirm a reboot applied the running kernel. Source: https://www.securityweek.com/ No other unique network automation developments tonight. --- AI IN INFRASTRUCTURE & AIOPS BeyondTrust Used Claude Opus 4.8 to Find Its Own Critical Flaws All three BeyondTrust CVEs patched today were found internally using Anthropic Claude Opus 4.8 and proprietary tooling. No external researcher, no bug bounty, no in-the-wild discovery. AI-assisted internal security assessments are producing findings that would previously have required a dedicated red team engagement, and the ROI math on that is worth a conversation with any client running PAM tooling. Source: https://thehackernews.com/2026/07/beyondtrust-patches-critical-auth.html HubSpot Scales Semantic Search to 20 Billion Vectors HubSpot's internal semantic search platform grew from a PoC to a 20-billion-vector production system. The infrastructure detail here is the scaling architecture, not the AI feature. Vector database infrastructure is an enterprise-scale concern now; any enterprise building internal AI search needs to plan for this operational overhead from the start. Source: https://www.infoq.com/news/2026/07/hubspot-semantic-vector-search/ --- HARDWARE, GPU & COMPUTE FuriosaAI RNGD Accelerators Land in Equinix Lisbon DCs South Korean chip startup FuriosaAI has placed its RNGD AI accelerators in Equinix's Lisbon datacenters. This is the first meaningful non-Nvidia/AMD AI accelerator footprint in European colocation infrastructure. Worth tracking as a procurement option for EU-domiciled AI inference workloads where power cost and availability are the binding constraint. Source: https://www.theregister.com/ai-and-ml/2026/07/07/south-korean-chip-startup-furiosaai-invades-european-datacenters/ No hardware vulnerability or network equipment advisories surfaced tonight beyond those already covered in the security sections. --- NETWORK MANAGEMENT & MONITORING No notable developments tonight. --- MANAGED SERVICE PROVIDERS Iran-Linked MSP Supply Chain Campaign Covered in Cloud Platforms above; the direct MSP implication is that privileged access tools, shared credentials and under-monitored management plane access are the attack surface being exploited. MSPs need to treat their own toolstack security posture as client-facing risk, not internal IT hygiene. No other unique MSP developments tonight. --- IT VENDOR ECOSYSTEM & M&A Microsoft Pre-Owned Software License Appeal Dismissed A UK court rejected Microsoft's appeal in the ValueLicensing resale case, keeping the door open on secondary-market software license trading. For enterprise buyers and MSPs managing large Microsoft EA positions, this is a signal that alternative procurement channels for Microsoft licenses may gain ground. Watch for Redmond's next move, which will likely be a further appeal or a revised licensing model. Source: https://www.theregister.com/software/2026/07/07/court-tosses-microsofts-appeal-in-pre-owned-software-licenses-battle/ --- EDGE COMPUTING & IOT No notable developments tonight. --- SALES & REVENUE Pipeline Qualification Requires Explicit Commitment Signals, Not Interest Signals Most salespeople mistake a prospect's engagement for a buying signal. Engagement means the prospect finds value in the conversation; commitment means they've taken an action with cost (time, money, political capital). Qualifying on interest fills pipelines with noise; qualifying on demonstrated commitment produces accurate forecasts. Source: (Goodreads compounding) The Referral Ask Has a Timing Window Customers are most willing to refer immediately after a problem is solved, not after a period of routine satisfaction. Waiting for the "right moment" means missing the window. Building a referral ask into the post-resolution touchpoint captures advocacy at peak emotional relevance, not after it fades into routine service expectation. Source: (Goodreads compounding) --- REAL ESTATE & INVESTMENT Operating Expense Underwriting Determines Actual Returns Most investors underwrite gross rent and cap rate, then apply a percentage for operating expenses without itemizing them. Properties with deferred maintenance, aging HVAC or management-intensive tenant profiles carry expenses that percentage estimates miss. Line-item expense underwriting before close is the differentiator between projected and realized cash-on-cash returns. Source: (Goodreads compounding) Market Cycle Position Changes Which Metrics Matter In early-cycle expansion, vacancy compression drives returns. In late-cycle, rent growth slows and expense inflation accelerates. Investors applying the same underwriting model across cycle positions systematically overpay at peak and underbid at trough. Knowing where you are in the cycle determines which line items deserve the most scrutiny. Source: (Goodreads compounding) --- SELF HELP, HUMAN PSYCHOLOGY & DARK PSYCHOLOGY Reciprocity Creates Obligation Without Consent The principle of reciprocity operates before the target is aware of it. When someone receives an unsolicited favor, gift or concession, the social obligation to repay activates automatically. In influence contexts, the initiating party controls the terms of what's given and therefore shapes the perceived value of what's owed. Recognizing this pattern in incoming gestures is the first line of defense against it. Source: (Goodreads compounding) Contrast Framing Distorts Perceived Value The brain doesn't evaluate options in absolute terms; it evaluates them relative to what was presented first. A mediocre option presented after a clearly poor one appears strong. This is why skilled negotiators present their preferred offer after a deliberately less favorable one, and why the sequence of options in a proposal changes which one feels like the obvious choice. Source: (Goodreads compounding) --- WHAT TO WATCH The combination of DEBULL's MFA-bypass PhaaS going operational and Januscape PoC code dropping publicly in the same week creates a compressed response window for enterprise security teams. Device-code flow restriction in Conditional Access and confirmed KVM kernel patching are the two controls that need to move from backlog to done this week, not next. --- CONVERSATION STARTER BeyondTrust found three critical vulnerabilities in its own PAM platform using AI-assisted internal security testing, no external researcher required. That's the most concrete data point yet that AI-augmented internal security assessment is producing findings at the same severity tier as formal red team engagements, at a fraction of the cost and time. ===========================================