Alex: Good morning. It's Friday, September 18th, 2026. You're listening to Cleartext. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Alex: Jordan, I know where you want to start.

Jordan: Yeah. Cisco ISE. Two actively exploited zero-days in two days, the latest one rated maximum severity. If you run Cisco Identity Services Engine, and most large enterprises do, your network access controls are potentially compromised right now. That's not a Tuesday problem. That's a right-now problem. We'll get into it.

Alex: We will. We've also got a SaaS supply chain attack that turned a single stolen API key into a vector hitting thousands of downstream websites, CISA making two significant moves that will change how you run your vulnerability and detection programs, Chinese APT expansion into Latin America, a claimed breach of Russian election infrastructure right before a parliamentary vote, the FBI investigating cyberattacks on ships in US waters, and researchers who used one AI company's model to hack into another AI company's systems. Plus a zero-click RCE that hits the four major AI coding agents your developers are probably running right now. It's a full show. Let's get to it.

Jordan: Let's start with Cisco because this demands action. CVE-2026-76460, maximum severity, actively exploited in the wild, affecting Cisco Identity Services Engine. ISE is the backbone of network access control and authentication for a huge swath of enterprise networks. This is the third actively exploited vulnerability in this product since June of last year. That's not a pattern, that's a campaign. Someone is systematically going after this product.

Alex: And the implications are profound. ISE is your gatekeeper. It decides who gets on the network, what they can access, how they're authenticated. If an attacker owns ISE, they don't need to move laterally in the traditional sense. They can rewrite the rules. If you haven't already initiated emergency patching or stood up compensating controls, this is a drop-everything moment. And for the board conversation, this is a good case study in concentration risk. When a single vendor product is this central to your security architecture and it gets hit three times in fifteen months, you need to be asking hard questions about architectural resilience.

Jordan: Agreed. And frankly, if your NAC vendor is becoming your primary attack surface, something is structurally wrong.

Alex: Let's stay on vulnerabilities because the second one is equally urgent for a different reason. Plugin4Shell. Zero-click remote code execution affecting all four major AI coding agents: Claude Code, Codex, GitHub Copilot, and Gemini CLI. Researchers are calling it the first supply chain vulnerability of the AI agent ecosystem. Two are patched, Anthropic's Claude Code and OpenAI's Codex. Two are not. GitHub Copilot and Gemini CLI remain vulnerable.

Jordan: And zero-click is the critical word here. A malicious plugin repository owner can exploit this without any interaction from the developer. The attacker gets the same access as the employee running the agent. Think about what that means. Your senior engineers, the ones with access to production repos, CI/CD pipelines, cloud infrastructure, their workstations become the beachhead. No phishing required.

Alex: If you've deployed these tools to engineering teams, and at this point most enterprises have at least piloted them, you need to verify versions immediately. Claude Code 2.1.179 and Codex 0.146.0 are patched. For Copilot and Gemini CLI, you need to make a risk decision right now about whether to restrict use until patches land. I know that's painful. I know engineering leadership will push back. But this is a zero-click RCE with full workstation access. The risk math is clear.

Jordan: And this connects to our next story in an interesting way. Researchers used Anthropic's Claude to autonomously exploit vulnerabilities in OpenAI's infrastructure. They achieved employee account takeover and accessed an internal code repository. This was responsible disclosure, both companies confirmed it, but the precedent matters enormously.

Alex: It does. We've been talking about AI-augmented offensive operations as a future threat for what, two years now? This isn't future anymore. An AI agent autonomously identified and exploited vulnerabilities in a sophisticated target. The defenders at OpenAI are not amateurs. This worked anyway. For threat modeling purposes, you now have to assume that AI agents are viable autonomous attack tools. That changes the speed calculus. It changes the scale calculus.

Jordan: And it creates an uncomfortable recursive loop. AI tools with vulnerabilities being exploited by AI tools. We're going to be living in that loop for a while.

Alex: Let's move to the Brevo supply chain attack because this is a masterclass in how third-party SaaS risk materializes. Attackers stole a Cloudflare API key from Brevo, the email and CRM platform, and used it to inject ClickFix malware distribution scripts into JavaScript files that Brevo serves to its customers' websites. One compromised credential, thousands of affected sites, millions of potential victims visiting those sites.

Jordan: The blast radius here is what matters. Brevo's customers embed Brevo's JavaScript on their own websites. So an attacker who compromises Brevo doesn't need to target each customer individually. They modify the source and the malware propagates through the trust chain automatically. It's the same structural problem we saw with the Magecart campaigns years ago, but now it's SaaS-to-SaaS.

Alex: For CISOs, this is a concrete example of why your third-party risk program needs to go beyond questionnaires. You need to understand what code your vendors are injecting into your web properties, how those assets are secured, and what happens when a vendor's cloud credentials are compromised. Subresource integrity, content security policies, runtime script monitoring, these aren't nice-to-haves. They're your blast shield.

Jordan: Now let's shift to the geopolitical landscape because it's busy. Start with FamousSparrow, a China-linked APT group that's deploying a new custom backdoor called SparroWocky against Latin American government agencies. This matters for two reasons. One, it represents a geographic expansion of Chinese cyber espionage operations into a region that many Western enterprises treat as lower-risk. Two, the retooling with new malware means existing detections are likely blind to it.

Alex: If your organization has operations in Latin America, government partnerships, or supply chain dependencies in the region, you need to update your threat model. Chinese APT targeting has historically concentrated on the Five Eyes nations, Southeast Asia, and Taiwan. Latin America was considered peripheral. That's clearly no longer the case. And the geopolitical context matters. This is happening against the backdrop of intensifying US-China competition for regional influence in Latin America. Cyber operations are a tool of that competition.

Jordan: Moving north to Russia. An anonymous hacking group claims to have breached systems connected to Russia's election infrastructure days before parliamentary voting begins. I want to be careful here because claims aren't confirmed breaches. But the timing is what matters for our audience.

Alex: It is. Whether the breach is real or overstated, the Russian government will use it to justify retaliatory operations. We've seen this playbook before. CISOs at critical infrastructure organizations, financial services, energy, anyone Russia considers a legitimate target for proportional response, should be elevating their monitoring posture through the voting window and for several weeks after.

Jordan: And the third geopolitical thread ties into this nicely. FBI and Coast Guard are actively investigating suspected cyberattacks on ships entering US waters. No attribution yet, no specific vector disclosed, but the fact that there's a joint federal investigation tells you the severity is real.

Alex: Maritime OT security has been a known gap for years. Vessels operate with outdated systems, limited segmentation, and they're connected to port infrastructure that supports critical supply chains. If you're in energy, logistics, or manufacturing with port-adjacent supply chain dependencies, this investigation should prompt a review of your maritime exposure. Don't wait for attribution to assess your risk.

Jordan: Let's pivot to two CISA moves that are going to reshape operational security programs. First, CISA is sunsetting its weekly vulnerability bulletin roundups. The reason is the AI-fueled avalanche of bug reports has made volume-based approaches unsustainable. They're moving to a prioritization-first model aligned with their SSVC framework.

Alex: This is a significant signal. The federal government is formally saying that tracking every CVE is no longer viable and they're not going to pretend otherwise. CISOs who haven't already shifted to exploitability-based and business-impact-based prioritization need to accelerate that transition. Your patch governance framework should be built around SSVC or something equivalent, not raw CVE counts in a weekly report.

Jordan: Second CISA move. They've released formal guidance recommending cyber deception, honeypots, decoy credentials, fake assets, as a detection and disruption mechanism for critical infrastructure. This is assume-breach doctrine formalized at the federal policy level.

Alex: And this is significant for the budget conversation. If you've been trying to justify deception technology investments to your board and getting pushback, you now have CISA guidance explicitly endorsing it. That's a regulatory tailwind. Deception technologies are force multipliers for detection. They don't replace your existing stack, but they give you high-fidelity signals that are extremely hard for attackers to distinguish from real assets.

Jordan: Last story. The HYPR report on fraudulent hires. Ninety-eight percent of fraudulent hires already possess company credentials before they're detected. There's a ninety-day gap between hiring and onboarding that creates a window where adversaries receive legitimate credentials directly from IT.

Alex: This is the North Korean IT worker problem quantified. We've been tracking these infiltration campaigns, and this data confirms what we suspected. The hiring-to-onboarding pipeline is a security gap that most organizations haven't instrumented. Pre-onboarding identity verification is now a security control, not just an HR process. Human intuition at the interview stage is not sufficient.

Jordan: The HYPR CEO put it well. Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT.

Alex: So, Jordan, as we close out the week, what's the thread here?

Jordan: Trust chain compromise. Every direction you look this week, the story is the same. Cisco ISE, the thing you trust to enforce access, is the attack surface. Brevo, a vendor you trust to serve JavaScript on your site, becomes the malware vector. AI coding agents you trust to help developers become zero-click attack paths. Employees you trust enough to hire receive credentials before you realize they're adversaries. The entire week is about the infrastructure of trust being weaponized.

Alex: And the response can't be to trust nothing, because that's not operationally viable. The response is to verify continuously, instrument your trust boundaries, and assume that any trust chain can be compromised. The organizations that are doing that, assume-breach architecture, continuous identity verification, runtime monitoring of third-party code, deception for post-intrusion detection, they're the ones who will weather weeks like this. The ones still relying on perimeter defense and periodic audits will not.

Jordan: Patch Cisco ISE today. Check your AI coding agent versions today. Review your Brevo exposure today. Everything else can wait until Monday. Almost everything.

Alex: That's our show for Friday, September 18th. Show notes and links to every story we covered are at cleartext.fm. Have a good weekend. Stay sharp. We'll see you Monday.

Jordan: See you Monday.