Alex: Welcome to Cleartext. It's Friday, August 21st, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: So Jordan, you want to start with the one that probably had every identity team's phone buzzing at three in the morning?

Jordan: Yeah, let's just address the elephant in the room. CVE-2026-69836. A perfect ten CVSS score in Microsoft Entra ID. Unauthenticated remote code execution against the identity backbone that underpins Microsoft 365, Azure, and every third-party app you've federated through it. This was actively exploited in the wild before Microsoft patched it.

Alex: And I want to be precise here because precision matters on this one. Microsoft has already patched this on the back end for cloud-managed tenants. If you are fully cloud-managed, no customer action is required. The patch is applied. But here's the nuance that matters for CISOs: you need to understand whether you had exposure during the window before the patch. If you're running hybrid configurations, if you have custom integrations touching Entra ID, you need to verify your posture. And critically, you should be hunting for anomalous identity activity right now. Token issuance patterns, unusual app consent grants, lateral movement from service principals.

Jordan: Right. The vulnerability itself is patched, but the question is whether someone already walked through the door while it was open. And when the door in question is your entire identity plane, the blast radius of a missed intrusion is essentially everything. Every SaaS app, every Azure resource, every conditional access policy. If an attacker got in, they could have minted tokens, elevated privileges, and established persistence that survives the patch.

Alex: This is one of those moments where you go to your board and say, this is why we invest in identity threat detection and response. This is why we have logging fidelity on our identity plane. If you don't have that visibility, this is your wake-up call.

Jordan: Agreed. Now let's talk about the story that I think has the most strategic weight this week, and it's the convergence of AI and OT attacks. The U.S. government issued an active threat advisory on Wednesday confirming that attackers are using AI-generated exploit scripts to target Siemens S7 PLCs in critical infrastructure. Water systems specifically. This is attributed to Iran-linked groups, and it's not theoretical. It's happening now.

Alex: Let me frame why this is a different conversation than the OT threats we've been discussing for years. We've always known that PLCs were vulnerable. We've always known that water utilities were under-resourced. What's changed is the attack economics. AI-generated exploit scripts mean that the barrier to developing ICS-specific offensive tooling has collapsed. You no longer need a team of specialized OT researchers spending months on reverse engineering. You can generate functional exploit code at scale, disguised as legitimate monitoring tools, and deploy it against a target set that has historically relied on obscurity as its primary defense.

Jordan: And the disguise element is important. These scripts are crafted to look like legitimate monitoring tools. So even if a utility operator notices something new running, it might pass a casual inspection. That's social engineering at the code level, and AI makes it trivially easy to generate plausible-looking instrumentation.

Alex: The Cybersecurity Dive piece adds the political dimension here. Support is growing for stricter federal oversight and mandatory OT security standards for water utilities. CISOs outside the water sector should pay attention because regulatory momentum in one critical infrastructure vertical tends to spread. If you have OT exposure in energy, manufacturing, transportation, anticipate that whatever compliance framework emerges for water will inform what comes for you next.

Jordan: And this connects directly to the second major thread this week, which is the broader picture of nation-state pre-positioning. The Wired piece on the Volt Typhoon war game simulation is genuinely worth reading. It describes a tabletop exercise simulating China's activation of pre-positioned access across U.S. civilian infrastructure during a geopolitical conflict. And the framing they use, digital bombs, is apt. These aren't smash-and-grab operations. They're dormant footholds designed to be activated at a moment of maximum strategic leverage.

Alex: The war game scenario is valuable because it gives CISOs a concrete narrative for board conversations. When you tell your board that a nation-state adversary has likely pre-positioned access in infrastructure your business depends on, and that this access is designed to be activated during a Taiwan contingency or similar flashpoint, that reframes cybersecurity from an IT problem to a business continuity and geopolitical risk problem. And boards understand geopolitical risk.

Jordan: Then layer on the SilkParasite campaign. Recorded Future's reporting confirms that suspected Chinese military-grade hackers used AI to develop malware targeting Central Asian governments. This is one of the first confirmed instances of AI-assisted malware development attributed to a nation-state. Not AI-assisted phishing. Not AI for target research. AI writing the malware itself.

Alex: So if we step back and look at the pattern across these three stories, what we're seeing is AI becoming an operational multiplier for nation-state offensive programs on two separate fronts. Iran using AI to generate ICS exploits against U.S. water infrastructure, China using AI to develop espionage malware against Central Asian governments. This is the threat landscape shift we've been anticipating, and it's now confirmed and active.

Jordan: And here's what I'd say to CISOs who think this is someone else's problem because they don't operate water plants or Central Asian government networks. Your supply chain does. Your cloud providers depend on that infrastructure. Your employees' homes get water from those utilities. The blast radius of critical infrastructure disruption doesn't respect industry verticals.

Alex: Absolutely. Now let's shift to the Rust supply chain attack, because this is a different kind of supply chain risk but equally significant. Three widely used Rust crates, arrayref, internment, and append-only-vec, were poisoned through a compromised maintainer account on crates.io. The malicious versions executed remote payloads at build time. Combined, these crates have 245 million downloads.

Jordan: Build-time execution is the key detail. This isn't malware that runs when your application runs. It executes during compilation. Which means it can infect your CI/CD pipeline, your build servers, your developer workstations, and none of your runtime security controls, your EDR, your container scanning, will see it. By the time your application is built and deployed, the compromise has already happened upstream.

Alex: The Rust Project has deleted the malicious versions, but if your organization built against these crates during the exposure window, you may have compromised build environments. The action item is concrete. Check your dependency trees. Check your lock files. If any of these crates appear at the affected versions, treat your build environment as compromised and rebuild from clean infrastructure.

Jordan: This is also a governance story. How many organizations have real-time visibility into which open-source packages their developers are pulling into builds? If you don't have a software bill of materials practice that covers your build dependencies, not just your runtime dependencies, you have a blind spot that attackers are actively exploiting.

Alex: Let's talk about the Alation breach. For listeners who aren't familiar, Alation is an enterprise data catalog and AI platform. They index your sensitive data assets, your access policies, your data lineage. Think of it as a map of where all your important data lives and who can access it. They confirmed unauthorized access to their systems on Tuesday.

Jordan: The irony is thick here. A company whose entire value proposition is knowing where sensitive data lives just had someone else gain unauthorized access to that knowledge. If you're an Alation customer, the question isn't just what data did they lose. It's whether an attacker now has a detailed map of your data architecture, your classification schemes, your access policies. That's intelligence that makes every subsequent attack against you more efficient.

Alex: Exactly. This is a third-party risk scenario where the vendor's compromise directly amplifies your own risk profile. If you use Alation, get on the phone with your account team, understand the scope, and assess what organizational metadata was accessible.

Jordan: Now two governance stories I want to hit quickly because they're both strategically important. First, Fitch Ratings published reports explicitly linking cyber resilience to credit ratings for water and healthcare organizations. Not cyber prevention. Resilience. Meaning your ability to take a hit and recover quickly.

Alex: This is a gift for CISOs. When a credit rating agency says your organization's bond rating could be affected by your incident response capability, you now have a financial instrument tied to your security program maturity. That's a language boards speak fluently. If you're in a debt-financed sector, healthcare, utilities, higher education, take this Fitch analysis to your CFO and your board.

Jordan: Second governance item. Axiad research shows nearly half of enterprises have no one leading post-quantum cryptography migration. No designated owner. This is going to become an audit finding fast. NIST standards are finalized. Federal mandates are in motion. CMMC and NIS2 updates will formalize quantum-readiness requirements. If you don't have someone owning PQC migration in your organization, assign it now before your auditor assigns it for you.

Alex: And briefly on the push to designate AI as the 17th critical infrastructure sector. CISA is actively exploring this. If it happens, AI providers will face sector-specific security baselines, information-sharing obligations, and federal coordination requirements. If your organization provides AI services or is heavily dependent on AI infrastructure, this could reshape your regulatory landscape materially. Track it.

Jordan: So let's talk about the thread that ties this week together. I think we're looking at the week where AI as an offensive weapon went from theoretical to confirmed and multi-front. Iran using AI to generate ICS exploits. China using AI to write espionage malware. And on the defensive side, we're still arguing about who owns PQC migration and whether AI should be critical infrastructure.

Alex: That asymmetry is the story. Adversaries are operationalizing AI faster than defenders are organizing around it. The action for CISOs this week isn't any single patch or policy change. It's an honest assessment of whether your threat model reflects the adversary that actually exists today, not the one from eighteen months ago. AI-assisted offensive operations are here. Your defensive assumptions, your detection logic, your threat intelligence consumption, all of it needs to account for the speed and scale that AI gives attackers.

Jordan: And the identity story with Entra ID is the reminder that even when your cloud provider patches fast, the window of exposure matters. Assume breach isn't just a philosophy. It's an operational requirement. Hunt for what might have happened during every exposure window, because your adversaries are absolutely taking advantage of them.

Alex: That's our show for today. Show notes and links to every story we covered are at cleartext.fm. Have a good weekend, everyone. We'll see you Monday.

Jordan: Stay sharp.