🗂️ The Tenant Desk

Thursday, August 13, 2026

12 stories · Standard format

Generated with AI from public sources. Verify before relying on for decisions.

🎧 Listen to this briefing or subscribe as a podcast →

Active remote-code exploits targeting on-premises SharePoint servers escalate this week's critical security deadlines. Elsewhere in the stack, enterprise AI developers are exploring asynchronous 'dreaming' states for memory consolidation, while Massachusetts residents secure a court injunction against data center diesel expansions.

Microsoft 365 & SharePoint

Rapid7 Details SharePoint RCE Chain Combining JWT Bypass with Deserialization Flaw

Building on Tuesday's disclosure of the critical CVE-2026-55040 JWT authentication bypass we tracked, Rapid7 detailed a two-bug exploit chain that combines the flaw with an unsafe .NET type instantiation in Business Connectivity Services (CVE-2026-63520). The chain gives unauthenticated attackers remote code execution on on-premises SharePoint Servers, and active exploitation of the initial bypass is already confirmed in the wild.

For clients maintaining hybrid or on-premises SharePoint farms, applying August's cumulative updates must happen immediately; the 30-day window before full technical details are released on September 10 leaves unpatched servers completely exposed.

Verified across 4 sources: Undercode News · Cyber Kendra · BleepingComputer · gridthegrey.com

Copilot & Power Platform

Redesigned Copilot Studio Agent Platform Emphasizes Skill Imports and Persistent Memory

Following Copilot Studio's recent transition to general availability, detailed walkthroughs of the rebuilt platform highlight a shift toward multi-agent orchestration, structured SKILL.md file imports, and persistent conversation memory across enterprise workflows.

Consultants building custom agent solutions must adapt their design patterns from traditional topic flows to skill-based orchestration, while keeping a tight rein on Copilot Credits consumption during multi-agent handoffs.

Verified across 2 sources: HubSite 365 · DZone

Enterprise AI

Anthropic Proposes 'Dreaming' Architecture for Agent Memory Consolidation

At AI DevCon in London, Anthropic showcased an asynchronous 'dreaming' process for autonomous agents that cleans, updates, and organizes session memories into version-controlled filesystems rather than relying purely on vector embeddings.

Shifting agent memory from opaque vector stores to inspectable, versioned state files gives developers a viable path for auditing, rolling back, and governing agent knowledge in production software.

Verified across 1 sources: The New Stack

Bidirectional Inspection Emerges as Prerequisite for Securing Enterprise RAG Applications

Technical analysis published Wednesday highlights why traditional perimeter security fails for custom retrieval-augmented generation (RAG) systems, advocating for bidirectional runtime inspection covering prompt input filtering, document context verification, and output sanitization.

Without pre-execution filtering and context validation wrappers, custom internal copilots remain highly susceptible to indirect prompt injection and document poisoning attacks.

Verified across 1 sources: DEV Community

Politics, Fact-Checked

Press Freedom Groups Sue to Block Paid Early Access to Presidential Truth Social Posts

The Intercept and the Freedom of the Press Foundation filed a federal lawsuit challenging Truth Social's $100,000-per-month 'Truth API' service, which grants high-paying subscribers high-speed early access to official policy statements from President Donald Trump.

The case raises unprecedented First Amendment and public-records questions regarding the private monetization of official executive branch announcements before they enter the public domain.

Verified across 2 sources: The Intercept · Associated Press

Working-Class Economy

Houston Executive Order Raises Airport Worker Minimum Wage to $20 an Hour

Houston Mayor John Whitmire signed an executive order establishing an immediate $20-per-hour baseline wage for thousands of contracted airport service workers, with scheduled annual increments reaching $23 by 2028.

Direct municipal wage mandates represent one of the few immediate policy tools successfully raising living standards for lower-income service staff coping with persistent regional inflation.

Verified across 1 sources: Houston Chronicle

Bipartisan House Bill Proposes Freeing Municipal Bond Caps for First-Time Buyers

Lawmakers introduced the First-Time Homebuyer Affordability Act, aiming to lower mortgage rates for working-class buyers by exempting qualified mortgage revenue bonds from state private activity bond volume caps.

Removing volume cap limits on revenue bonds provides local housing finance agencies with immediate capital to offer below-market mortgage financing without requiring direct federal spending.

Verified across 1 sources: Bond Buyer

Cybersecurity

Varonis Discovers Legacy Entra ID WS-Trust Vector Bypassing Smart Lockout

Security researchers at Varonis published details showing how the legacy WS-Trust autologon endpoint—often left active for Entra Seamless SSO—can be abused to conduct password spraying without triggering Microsoft Smart Lockout or alerting standard sign-in telemetry.

Enterprise identity audits must look beyond standard conditional access logs to explicitly disable legacy WS-Trust endpoints and Seamless SSO flows that expose hybrid tenants to silent credential probing.

Verified across 2 sources: Undercode News · Varonis

EVs & Charging

IONNA and OEM Networks Lead Public DC Fast Charging Satisfaction Rankings

J.D. Power's 2026 U.S. EVX Public Charging Study shows overall satisfaction with DC fast charging rising as charging failure rates fell to 12%, with automaker-backed joint venture IONNA taking the top overall score.

The study demonstrates that capital investment by OEM consortia focused on high-power station maintenance is successfully reducing station downtime for non-Tesla EV drivers.

Verified across 2 sources: J.D. Power · GM Authority

New England Beat

Lowell Judge Blocks Diesel Generator Expansion at Major Massachusetts Data Center

A Massachusetts state judge issued an injunction blocking the owners of a large Lowell data center from installing four high-capacity diesel backup generators while a lawsuit filed by nearby residents over noise and emissions proceeds.

The ruling underscores the mounting legal and community resistance facing AI infrastructure expansion in New England, where municipal grid bottlenecks force developers into contentious local environmental battles.

Verified across 2 sources: WGBH · CommonWealth Beacon

Science & Space

Oticon Debuts Reveal Hearing Aid Built on Dual Speech and Context AI Architecture

Oticon launched its new Reveal hearing device, featuring a dual AI chip architecture that runs dedicated Speech AI and Context AI models simultaneously to improve speech clarity without completely suppressing ambient acoustic surroundings.

Moving away from blanket noise cancellation toward dual-stream contextual sound processing aligns digital hearing aid design more closely with natural auditory neurobiology.

Verified across 1 sources: Hearing Review

Consumer Tech Quirks

Zero-Click Zoom Meeting Vulnerability Uncovered via AI Prompt Research

Security researchers disclosed a cross-platform zero-click remote execution flaw in Zoom's annotation interface that allowed silent device takeover during active meetings. Researchers used generative models in under 20 prompts to discover the bug, which Zoom has since patched.

The incident demonstrates how quickly automated model workflows can uncover critical memory flaws in desktop and mobile client software, highlighting the necessity of immediate client patching across managed corporate devices.

Verified across 1 sources: Android Authority


The Big Picture

On-Premises Identity Layers Suffer Compounding Exploit Chains Vulnerabilities in legacy authentication protocols and deserialization endpoints are being chained together, creating unauthenticated remote code execution risks before standalone patches can be fully deployed.

Agentic State Management Transitions from Vector Storage to File Repositories Enterprise AI development is moving away from opaque vector databases for persistent agent memory, favoring version-controlled filesystems that support deterministic audit trails and rollbacks.

Municipal Grids and Courts Constrain Data Center Power Demands Local judicial rulings and municipal moratoria in New England demonstrate growing community friction against industrial backup power installations for AI data centers.

Public Charging Reliability Gains Driven by OEM Joint Ventures Independent scoring reveals that OEM-backed charging consortia are outperforming legacy networks by prioritizing hardware maintenance over rapid station expansion.

AI-Assisted Security Research Accelerates Zero-Day Discovery Timelines The use of generative models to uncover multi-step cross-platform flaws in meeting software and enterprise platforms is drastically shortening the window between vulnerability discovery and weaponization.

What to Expect

2026-09-01 Microsoft M365 Roadmap item 569213 rolls out Copilot Agent insertion shortcuts via the plus menu.
2026-09-10 Rapid7 scheduled publication date for full technical disclosure of SharePoint RCE flaw CVE-2026-63520.
2026-10-01 Microsoft begins formal phase-out and gradual shutdown of Exchange Web Services (EWS) for Exchange Online.
2026-11-03 Entra ID officially ends preview support for the 'MemberOf' rule operator in dynamic groups.

Every story, researched.

Every story verified across multiple sources before publication.

🔍

Scanned

Across multiple search engines and news databases

394
📖

Read in full

Every article opened, read, and evaluated

90

Published today

Ranked by importance and verified across sources

12

— The Tenant Desk

🎙 Listen as a podcast

Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.

Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste
Overcast
+ button → Add URL → paste
Pocket Casts
Search bar → paste URL
Castro, AntennaPod, Podcast Addict, Castbox, Podverse, Fountain
Look for Add by URL or paste into search

Spotify isn’t supported yet — it only lists shows from its own directory. Let us know if you need it there.