Alex: Welcome to Cleartext. It's Wednesday, August 26th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: We have a packed show today. Iran sanctions, a phishing kit that's chewing through Microsoft 365 at industrial scale, some critical vulns that need your attention this morning, and a cyber insurance trend that should change how you're thinking about risk transfer. Plus, a fascinating CISA red team report that gives us a rare apples-to-apples comparison between sectors. But Jordan, let's start where you want to start.

Jordan: Yeah, let's start with the Treasury sanctions because the language coming out of Washington yesterday was notably aggressive. Treasury announced sanctions against Iranian cyber actors, and they framed it as part of an "unprecedented, whole-of-government economic campaign" to sever Iran's financial connections globally. The stated objective, and I'm quoting here, is to "sever every economic lifeline that sustains this tyrannical regime." That's not diplomatic hedging. That's an escalation posture.

Alex: And for our audience, the immediate question is what does this mean operationally. If you're in critical infrastructure, energy, water, transportation, you've been on notice about Iranian threat actors for years. But sanctions like these tend to correlate with retaliatory cyber activity. Iran has historically responded to economic pressure with cyber operations. It's one of their asymmetric levers.

Jordan: Exactly right. And the timing matters. We're seeing this alongside broader tensions in the region. Iranian-linked groups have a track record of going after operational technology environments, not just IT. They've hit water treatment facilities, they've probed energy infrastructure. The sanctions specifically tied to critical infrastructure breaches tell you what the intelligence community is seeing in terms of targeting.

Alex: So the action item here is straightforward. If you're a CISO at a critical infrastructure operator, this warrants a board-level briefing on geopolitical risk posture. Update your threat intelligence feeds. Make sure your attribution intelligence is current. And honestly, if you don't have a relationship with CISA's regional office, today's a good day to start one.

Jordan: And if you're not in critical infrastructure, don't tune out. Iranian groups have targeted financial services, healthcare, and tech companies as secondary objectives. The blast radius of geopolitical escalation doesn't respect sector boundaries.

Alex: Let's pivot to something that hit a lot of inboxes yesterday. Mirage2FA. Jordan, this one is significant at scale.

Jordan: This is a phishing-as-a-service toolkit that has been running a campaign against Microsoft 365 accounts across more than 4,500 companies in the US and EU between 2024 and now. ANY.RUN's research suggests 48 percent of targeted email addresses were potentially compromised. Let that number sit for a second. Nearly half.

Alex: And the mechanism here is what makes it dangerous. This isn't your garden-variety credential phishing page. Mirage2FA is an adversary-in-the-middle kit that abuses legitimate Microsoft login flows in real time. It proxies the actual authentication process, which means it captures session tokens after the user has completed MFA. Your user does everything right, they authenticate properly, and they still get compromised.

Jordan: This is the story that should finally kill the "we have MFA, we're fine" narrative in any remaining boardroom where it still lives. MFA is necessary. It is not sufficient. The answer here is phishing-resistant authentication. FIDO2, passkeys, hardware tokens. And Conditional Access policies that evaluate device compliance, network location, and risk signals before granting session tokens.

Alex: If you're running Microsoft 365 at enterprise scale and you haven't deployed phishing-resistant MFA, this is your case study for the budget conversation. Forty-eight percent potential compromise rate across thousands of companies. That's the number you bring to your CFO.

Jordan: And check your Conditional Access policies. Token theft mitigation, continuous access evaluation, those need to be on. Not tomorrow. Today.

Alex: Let's stay on the breach and vulnerability track for a minute because we have three active exploitation stories that need attention this morning. Jordan, rapid fire.

Jordan: First, CVE-2026-60004 in Gitea. CVSS 9.8. Unauthenticated remote code execution. If you have write access to a repository, you can execute arbitrary shell commands on the server. CISA added it to the Known Exploited Vulnerabilities catalog yesterday. Attacks in the wild are dropping crypto miner payloads, but let's be clear, the capability is full server compromise. If you self-host Gitea for source code management, this is a patch-now event. Your source code is the crown jewel.

Alex: Second, Zimbra. Over 270 Zimbra Collaboration Suite servers already compromised through an RCE flaw. CISA has ordered federal agencies to patch. And here's the detail that should bother you: Zimbra's developer took nearly a full month to release a patch after initial disclosure. A month. Your email platform, with access to every sensitive communication in your organization, sitting exposed for a month.

Jordan: And third, TeamCity. Both Australian and US government agencies have issued urgent advisories for active exploitation of a critical JetBrains TeamCity flaw. TeamCity sits in CI/CD pipelines. Compromise here means an attacker can inject malicious code into your build process. This is supply chain attack infrastructure. If you're running TeamCity, patch immediately and audit your build pipeline integrity.

Alex: Three different platforms, three active exploitation campaigns, all hitting infrastructure that touches your most sensitive assets: source code, email, and software delivery. If you're a CISO hearing this, the question isn't whether to patch. It's whether your vulnerability management program can actually execute on three simultaneous emergency patches across different teams. That's the real test.

Jordan: And this connects directly to the Gartner survey that dropped today. Three hundred sixteen risk managers ranked AI-assisted vulnerability discovery as the number one emerging risk by impact in Q2 2026. Three months earlier, it wasn't even in the top five.

Alex: That's a dramatic shift in perception.

Jordan: It is, and it's grounded in reality. AI systems are lowering the bar for discovering previously unknown flaws. The window between a vulnerability existing and being actively exploited is compressing. What used to be weeks or months is becoming days. The three vulns we just discussed, that's the current tempo. It's going to accelerate.

Alex: Which means your patching SLAs need to reflect this new reality. If your organization's standard remediation window for critical vulnerabilities is still 30 days, you are operating on assumptions from a different era. Threat modeling needs to account for faster adversarial exploit development. This is a structural change, not a temporary spike.

Jordan: Let's talk about the Paylogix breach because it illustrates a different dimension of risk. Akira ransomware hit an employee benefits administration platform and stole sensitive financial and health data on tens of thousands of individuals.

Alex: This is the third-party vendor risk story that keeps repeating. Your HR tech stack processes some of the most sensitive data in your organization. Health information, financial data, dependent details. And it's sitting in platforms that your security team may have limited visibility into.

Jordan: The action here is to review your vendor access controls and breach notification obligations in your benefits platform contracts. Most enterprises have dozens of HR tech vendors processing employee data. How many of those have you actually assessed in the last twelve months? How many have contractual obligations around notification timelines and remediation standards that you could actually enforce?

Alex: And this feeds into the broader affordability story from Dark Reading. Global cybersecurity spending is approaching 240 billion dollars annually. Breach costs are at record highs. But small and mid-sized businesses, many of which are your vendors, your supply chain partners, are dangerously underprotected. The affordability gap in SMB security creates systemic supply chain risk for large enterprises.

Jordan: You can spend whatever you want on your own defenses. If your benefits administrator, your logistics partner, or your regional law firm can't afford adequate security, their breach becomes your breach. That's the math.

Alex: Which brings us to the insurance side. Chubb reported that average losses per cyber claim are increasing even as total claim volume is declining. The driver is privacy litigation. Higher severity, lower frequency. Fewer incidents, but each one costs dramatically more.

Jordan: This is the trend that should reshape your risk transfer strategy. If you're in your annual cyber insurance renewal cycle, the conversation needs to include these loss trends. Underwriters are seeing this data. Your premiums and coverage terms will reflect it. And if you're not modeling privacy litigation exposure in your risk quantification, you're underestimating your tail risk.

Alex: One more story before we look ahead. CISA published a red team report comparing outcomes across a government agency and a water utility. Both were breached initially. The water utility detected, isolated, and shut down the intrusion before lateral movement. The government agency did not.

Jordan: This is rare. We almost never get sector-level benchmarking on detection and response capability from a credible source. The water sector organization did what we all say we want to do. They detected adversary activity early and contained it before it mattered. The government organization failed that test.

Alex: For CISOs, this is a reference point. Use it. When you're justifying investment in detection engineering, in incident response readiness, in purple teaming, this report gives you a credible external benchmark. CISA tested two organizations under comparable conditions and got dramatically different outcomes. The difference was detection and response maturity.

Jordan: And the fact that it was a water utility that succeeded is worth noting. This isn't a Fortune 50 company with unlimited budget. It's an organization that prioritized the right capabilities.

Alex: Let's close with outlook. Jordan, what's the thread that ties today together?

Jordan: Compression. Time to exploit is compressing. The gap between vulnerability discovery and weaponization is shrinking because of AI. The gap between a phishing kit being developed and compromising thousands of companies is shrinking because of commercialization. And the gap between geopolitical tension and cyber retaliation is shrinking because that's the playbook now.

Alex: And on the business side, the cost per incident is going up while the window to prevent it is going down. That's the fundamental challenge. Your board needs to understand that the threat landscape isn't just getting more dangerous, it's getting faster. Your security program's value isn't just measured in what it prevents. It's measured in how quickly it can detect and contain what gets through.

Jordan: Watch the Iran situation. If we see retaliatory cyber operations in the next few weeks, it won't be a surprise. But preparation beats prediction every time.

Alex: That's the show for today. Show notes and links to every story we covered are at cleartext.fm. Thanks for listening. We'll see you tomorrow.

Jordan: Stay sharp.