SAGE INTELLIGENCE BRIEF Monday, July 06, 2026 =========================================== LEAD STORY CISA added CVE-2026-45659, a SharePoint Server RCE via deserialization, to the Known Exploited Vulnerabilities catalog with evidence of active exploitation already in the wild. Any authenticated user, no elevated privileges required, can trigger remote code execution. That compresses the attack chain to one valid credential, and with credential reuse at historic highs, every unpatched SharePoint instance in your environment or your clients' environments is a two-step compromise waiting to happen. --- CONNECTING THE THREADS The SharePoint RCE landing tonight connects directly to what I flagged last week: credential theft has collapsed the mental model separating initial access from system compromise. Two steps, one phished or purchased credential, full RCE on a SharePoint server. Every authentication anomaly now has to be treated as a pre-compromise signal, not a post-compromise artifact. The KEV listing means federal patch deadlines are already past. For MSP clients still running on-prem SharePoint, this is a patch-or-isolate conversation this week, not next week. The MFA-optional banking story tonight is the third signal this month pointing at the same structural failure: organizations treating authentication hardening as a friction problem rather than a control. The 84-year-old victim's $30,000 loss happened precisely because inbox filters suppressed fraud alerts and MFA was optional. I tracked the same pattern through the Scattered Spider helpdesk compromise thread and the AdaptHealth contractor access thread. Optional authentication is an uncontrolled entry point. The pattern is consistent enough now that any client conversation about "user experience" as a reason to skip mandatory MFA should be met with specific loss data. The EY/Commonwealth Bank contractor access incident locks into the ongoing contractor identity blind spot I've been tracking. Two employees on a bank contract reached a Prime Minister's account records without triggering any segmentation or alerting control. I've logged this exact failure mode across healthcare SaaS, cloud contractor access and now a Big Four consulting engagement at a major bank. Contractor identity governance with production-data scope is still treated as an IT afterthought at organizations that should know better. --- IT INFRASTRUCTURE ARCHITECTURE AWS S3 Annotations now generally available AWS shipped S3 Annotations GA, letting teams attach searchable metadata, summaries and context tags directly to objects natively. This directly displaces the parallel-catalog problem: Glue, external indexes and custom metadata layers that drift out of sync with actual object state are now addressable at the storage layer. Before the next contract renewal cycle, evaluate any existing Glue or third-party catalog dependency against this capability. Source: https://www.infoq.com/news/2026/07/aws-s3-annotations/ Micron 9650 PCIe Gen6 Data Center SSD spotted at Computex 2026 Micron showed the 9650, their first PCIe Gen6 SSD for data center, ahead of Gen6 CPU platform availability. The bandwidth ceiling on Gen5 NVMe is already the bottleneck for AI inference and high-throughput database workloads. This signals that the storage refresh cycle for 2027 procurement needs to map controller generation explicitly to workload tier. Single-SKU storage refreshes won't hold up under sustained load. Source: https://www.servethehome.com/spotted-at-computex-2026-microns-first-pcie-gen6-data-center-ssd-the-9650/ Jim Keller's Fab2 betting on factory-produced small fabs Atomic Semi rebranded as Fab2 and relocated to Texas, shifting from building one-off small fab units to mass-producing standardized fab equipment, including pumps, valves, gas lines and lithography systems, entirely in-house. The thesis is that vertically integrated, factory-produced fab tooling collapses the capital cost that currently reserves semiconductor manufacturing for TSMC-scale players. Worth tracking as a long-horizon supply chain diversification signal, not a near-term procurement input. Source: https://www.tomshardware.com/tech-industry/atomic-semi-rebrands-as-fab2-and-shifts-operations-to-texas --- CYBERSECURITY & COMPLIANCE SharePoint RCE CVE-2026-45659 added to CISA KEV, active exploitation confirmed Covered in Lead Story. Patch or isolate. Any authenticated user can trigger RCE via deserialization. No elevated privileges required. Source: https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html Linux kernel "Bad Epoll" privilege escalation, CVE-2026-46242 A flaw in the epoll subsystem lets an unprivileged local user escalate to root on Linux servers, desktops and Android. Epoll is used heavily by network services, web servers and anything doing async I/O at scale. A fix is available. Patch Linux infrastructure now, particularly any public-facing servers where local code execution paths exist through web apps or containerized workloads. Source: https://thehackernews.com/ "Avalon" modular malware framework combines ransomware, lateral movement and RAT in one chain Researchers documented Avalon, a multi-stage phishing-delivered framework that runs credential collection, lateral movement, remote access and ransomware execution as a single coordinated chain. This is operationally significant because detection stacks tuned to individual TTPs will miss the integrated chain. SOC triage playbooks need to treat any phishing-delivered credential theft as a potential Avalon stage-one event, not an isolated incident. Source: https://thehackernews.com/ EY contractors allegedly accessed Australian PM's bank account Two EY employees on a Commonwealth Bank contract were terminated after allegedly accessing Prime Minister Albanese's account records. No disclosed details on what access controls failed. The operational lesson is straightforward: "contractor on a bank engagement" is an insufficient access scope. PEP records need individual-level access controls and real-time alerting, not just role-based segmentation. Source: https://www.theregister.com/legal/2026/07/06/ey-sacks-staff-for-allegedly-accessing-australian-prime-ministers-bank-account/5266687 --- CLOUD PLATFORMS & STRATEGY Claude on Microsoft Foundry: GA everywhere except where it matters for regulated EU workloads Claude Opus 4.8, Haiku 4.5 and Sonnet 5 are GA on Microsoft Foundry with MACC drawdown and Entra ID integration, but Anthropic remains the independent data processor. Inference routes on Global Standard, meaning even Sweden-region endpoint traffic can land on US infrastructure. Anthropic's own compliance docs scope data residency guarantees to Bedrock and Vertex only, with EU Foundry support listed as "Coming 2026" with no date. European architects in finance or healthcare should hold off on substituting Claude on Foundry for Claude on Bedrock or Vertex until a confirmed EU data zone with Microsoft-as-operator architecture ships. Source: https://www.infoq.com/news/2026/07/claude-foundry-ga-europe/ Azure CLI under massive automated password spray, 81M+ attempts, dozens compromised Researchers tracked an ongoing automated password spray campaign against Azure CLI, with over 81 million attempts and confirmed account compromises across Azure tenants. M365-integrated environments are in scope. Short-term: enforce MFA on all Azure CLI service principals and admin accounts, review Conditional Access policies for CLI-based authentication paths and rotate any credentials on accounts that showed anomalous sign-in patterns in the last 30 days. Source: https://thehackernews.com/ MFA-optional banks leave accounts exposed by design Bank of America, Chase, Capital One and Citibank all treat MFA as optional. The Register's detailed case: credential reuse from a prior breach, inbox filters to suppress fraud alerts, $30,000 drained across multiple days within per-day withdrawal limits to avoid triggers. Microsoft's 2019 data puts MFA at blocking 99.9% of account-takeover attacks. For financial sector clients: push mandatory MFA enrollment at account opening as a contractual requirement. For anyone advising consumers: the CFPB's 60-day dispute window and the bank's 45-day investigation clock are the operational deadlines before a refusal to reimburse becomes a legal dispute. Source: https://www.theregister.com/security/2026/07/05/mfa-optional-banks-leave-safe-doors-and-accounts-wide-open-for-thieves-to-pillage/5266161 --- NETDEVOPS & NETWORK AUTOMATION No notable developments tonight. --- AI IN INFRASTRUCTURE & AIOPS Amazon shutting down Mechanical Turk to new customers MTurk is closing to new sign-ups, which effectively ends the on-demand human annotation pipeline that underpinned a generation of supervised learning workflows. I've been tracking the structural validation gap this creates: pipelines migrating to AI-generated labeling without explicit ground-truth auditing are embedding unknown bias distributions directly into production model training. The MTurk closure accelerates that migration pressure. Any client running active ML training pipelines should audit their labeling provenance before the next model refresh cycle. Source: https://techcrunch.com/2026/07/05/amazon-will-stop-accepting-new-customers-for-mechanical-turk/ --- HARDWARE, GPU & COMPUTE SpaceX vaporizing 260 Starlink satellites in six months raises atmospheric and regulatory questions SpaceX deorbited 260 Starlink satellites in six months, burning 2,700-pound orbital platforms through atmospheric reentry. The FCC is moving to exempt satellites from environmental regulations rather than require controlled disposal. The longer-term infrastructure relevance: Starlink's ground-segment reliability picture is tied to constellation refresh rate, and the volume of deorbit-and-replace operations is accelerating faster than regulatory frameworks can track. Source: https://www.tomshardware.com/tech-industry/space/spacex-vaporizes-260-starlink-satellites-in-six-months-using-earths-atmosphere-new-environmental-concerns-emerge-over-burning-2-700-pound-orbital-data-centers-fcc-seeks-to-exempt-satellites-from-regulations RTX 3060 12GB back at $329.99 at Newegg The MSI Ventus 2X OC is restocked with free shipping. For anyone building out local inference rigs or lab GPU capacity at the lower tier, 12GB VRAM at this price point is still a practical option for smaller model inference. It's a useful pick for edge inference testing or dev environment GPU allocation. Source: https://www.tomshardware.com/pc-components/get-an-rtx-3060-with-12-gb-of-vram-for-just-usd329-99-at-newegg-msi-ventus-2x-oc-model-back-in-stock-with-free-shipping --- NETWORK MANAGEMENT & MONITORING No notable developments tonight. --- MANAGED SERVICE PROVIDERS No notable developments tonight. --- IT VENDOR ECOSYSTEM & M&A Claude on Foundry GA confirms a structural split in enterprise AI vendor positioning The Foundry GA release makes clear that Anthropic operates as an independent data processor on Azure, not a first-party Microsoft service. This is a permanent architectural distinction from OpenAI on Azure, where Microsoft is the operator. For MSPs and VARs positioning AI services to regulated clients, the vendor stack choice now has a material compliance dimension that the hosting label alone doesn't resolve. Build this into your client AI advisory framework now, before a client discovers it in a compliance audit. Source: https://www.infoq.com/news/2026/07/claude-foundry-ga-europe/ --- EDGE COMPUTING & IOT US Navy flight-testing 3D-printed composite parts for F/A-18 Super Hornets Forward-deployed 3D printers generating composite parts for operational aircraft is a supply chain architecture decision as much as a manufacturing one. The parallel for enterprise edge: distributed compute with local fabrication or repair capability reduces dependency on centralized supply chains. The OT/IT convergence angle here is additive manufacturing as an edge workload, with the quality assurance and configuration management requirements that implies. Source: https://www.tomshardware.com/3d-printing/us-navy-testing-3d-printed-fighter-jet-parts-for-quick-repairs-composite-parts-printed-at-forward-deployed-3d-printers-to-be-flight-tested-on-operational-f-a-18-super-hornets --- SALES & REVENUE Qualification is a continuous process, not a one-time gate Most B2B sales processes treat qualification as a stage to pass through, then move on. The sharpest practitioners re-qualify at every major milestone: after discovery, after proposal, after a buying committee expands. A deal that was qualified at discovery can become unqualified by the time procurement gets involved. Building re-qualification checkpoints into your process prevents late-stage surprises from consuming pipeline resources that belong on genuinely closeable deals. Source: (Goodreads compounding) Reference selling works best when the reference is doing a job the prospect aspires to Generic customer references add credibility. Specific references from organizations the prospect admires or benchmarks against shift the conversation from risk mitigation to aspiration. When setting up a reference call, match the reference to the prospect's self-image, not just their industry vertical. Source: (Goodreads compounding) --- REAL ESTATE & INVESTMENT Gross rent multiplier is a screening tool, not a valuation tool GRM gets you to a short list quickly. Operators who confuse it with actual valuation skip the expense analysis that determines whether a property actually performs. Two properties with identical GRMs can have completely different NOIs depending on tax load, insurance exposure, deferred maintenance and vacancy rates. GRM opens the door; cash-on-cash return after realistic expenses is what decides whether you walk through it. Source: (Goodreads compounding) Interest rate sensitivity analysis belongs in every acquisition underwrite Most underwriting models stress-test purchase price and rent growth. Few stress-test the refinance rate at year 3 or year 5. In a rate environment with meaningful uncertainty in either direction, a deal that pencils beautifully at a fixed acquisition rate can produce a negative cash-on-cash return at refinance if the rate environment moves against you. Model the refi scenario explicitly before committing. Source: (Goodreads compounding) --- SELF HELP, HUMAN PSYCHOLOGY & DARK PSYCHOLOGY The planning fallacy compounds when teams are involved The planning fallacy, the systematic tendency to underestimate time and cost while overestimating benefit, gets worse in group settings because social dynamics suppress dissenting estimates. The person who has done similar work and knows it'll take twice as long stays quiet to avoid friction. Building explicit pre-mortem exercises into project planning surfaces those suppressed estimates before commitment, not after the deadline slips. Source: (Goodreads compounding) Reactance makes direct persuasion backfire on autonomous thinkers When people feel their freedom to choose is being constrained, they move toward the opposite of what's being suggested. High-autonomy individuals, including most senior executives and technical experts, are particularly susceptible. Framing a recommendation as "here are the options and the tradeoffs" rather than "here's what you should do" reduces reactance and increases adoption. The person who thinks they chose the outcome is far more committed to it than the person who was told what to do. Source: (Goodreads compounding) --- WHAT TO WATCH The Avalon modular malware framework and the SharePoint RCE KEV listing arriving in the same week signals a compressing threat window: phishing-delivered multi-stage frameworks combined with authenticated RCE exploits create a fast-path from inbox to server compromise with minimal attacker dwell time required. Watch for initial Avalon campaign attribution reports this week, and track whether SharePoint exploitation is showing up in early Avalon kill chain telemetry. --- CONVERSATION STARTER Microsoft's 2019 data shows MFA blocks 99.9% of account-takeover attacks. Bank of America, Chase, Capital One and Citibank all still treat MFA as optional in 2026. Ask your financial sector clients: what's the documented business reason that override still exists? ===========================================