Alex: Good morning. It's Wednesday, September 23rd, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. This is Cleartext.

Jordan: So let's start here. ShinyHunters says they popped the FBI. Not a contractor, not some peripheral system. They claim they exploited an Oracle PeopleSoft zero-day to breach FBIjobs.gov and walk out with identity data on, and I'm quoting here, "almost all FBI agents" plus job applicants. The site is still down. The FBI says they're investigating. And if even a fraction of this is real, the counterintelligence implications are genuinely ugly.

Alex: That's where we're starting today, and it sets the tone. We've got a packed show. Chinese state actors chaining zero-days through Chrome and Windows. Record ransomware numbers. Emergency patches for Check Point and F5 that should have been on your desk yesterday. An AI-for-defense partnership in Ukraine that's worth watching closely. And on the governance side, the EU is admitting its cyber coordination is broken, the White House is doubling down on no AI regulation, and insurers are finally starting to define what they will and won't cover when AI goes sideways. Let's get into it.

Jordan: Back to the FBI breach. ShinyHunters is not a new name. These are the same operators behind a string of major breaches going back years. What's different here is the target and the claimed vector. An Oracle PeopleSoft zero-day. If that's confirmed, every organization still running on-prem PeopleSoft for HR, identity, payroll, you need to be treating this as a live threat right now. Don't wait for Oracle's advisory cycle.

Alex: And let's talk about what stolen FBI agent identities actually mean. TechCrunch made the point that foreign intelligence services could use this data to identify, approach, and potentially coerce agents into cooperation. That's not a data breach in the traditional sense. That's a counterintelligence event. And it cascades. If you're a defense contractor, a law firm doing federal work, a financial institution with a relationship to federal law enforcement, your threat model just shifted.

Jordan: The uncomfortable truth is that PeopleSoft is still load-bearing infrastructure at a shocking number of large organizations. It's one of those systems that's been on the migration roadmap for a decade but never quite gets replaced. And now we're seeing what that deferral costs.

Alex: Exactly. Legacy risk isn't theoretical anymore. It's an active exploitation vector. Let's pivot to the other major zero-day story, because this one is arguably more broadly impactful. UTA0565, a Chinese state-aligned group, chained three zero-days, two in Chrome, one in Windows ALPC, to achieve full compromise through drive-by websites. Browser to OS. No user interaction beyond visiting a page.

Jordan: This is the kind of exploit chain that makes defenders' stomachs drop. CVE-2026-85046, CVE-2026-87491 on the Chrome side, CVE-2026-85880 on Windows ALPC. Volexity confirmed that this exploit kit isn't just one group's work. It's being shared across multiple Chinese threat groups, which tells you this is an ecosystem-level capability, not a single operator. The tooling is being distributed like infrastructure.

Alex: So what should CISOs be doing right now?

Jordan: Three things. First, validate Chrome and Windows patch status across your fleet immediately. If you have systems that were unpatched between September 3rd and 4th, that's your exposure window. Second, pull your proxy and next-gen firewall logs for that same window and hunt against the IOCs Volexity published. Third, have an honest conversation about whether your endpoint controls would have caught a browser-to-kernel exploit chain. For most organizations, the answer is probably not without behavioral detection tuned for this.

Alex: And this connects directly to our vulnerability segment. Check Point and F5 both have critical zero-days under active exploitation. I want to be specific because this is actionable. Check Point Security Management Server, CVE-2026-93616, pre-auth remote code execution, exploited since July 23rd. That's two months of adversary access before patches dropped on September 22nd. And F5 BIG-IP APM, CVE-2026-94127, unauthenticated RCE on any system functioning as an OAuth authorization server.

Jordan: Let me underscore the Check Point timeline. July 23rd. If you're running Check Point Management Servers, you don't just need to patch. You need to threat hunt back to late July. Assume compromise, prove otherwise. And on F5, if your BIG-IP APM is configured as an OAuth authorization server, that's your crown jewels access control sitting behind an unauthenticated RCE. Engineering hotfixes are available now. Deploy them today.

Alex: Check Point also patched a Quantum Security Gateway RCE, CVE-2026-85102, on September 9th, and active probing started within days. The window between patch release and exploitation has essentially collapsed for perimeter devices.

Jordan: Perimeter devices are the new endpoints. Except they're worse because they're trusted by design, they're hard to instrument, and they often don't have the same patching discipline as your endpoint fleet. This is a pattern we've been warning about for two years and it's only accelerating.

Alex: Let's zoom out to the macro picture. NCC Group's data shows 1,073 confirmed ransomware victims globally in August 2026. That's the highest single-month total ever recorded. The industrial sector is the most heavily targeted vertical, which is consistent with multi-year trends but the volume is new.

Jordan: And here's the connection. Those Check Point and F5 zero-days we just talked about, plus the VeloCloud vulnerabilities from earlier this month, ransomware operators are riding the same exploitation waves as state actors. The initial access is often the same. What differs is the monetization. So when you see record ransomware numbers coinciding with a spike in enterprise infrastructure zero-days, that's not a coincidence. It's a supply chain effect. More zero-days in perimeter gear means more initial access for everyone, including ransomware affiliates who buy or find those footholds.

Alex: This is the data point CISOs need for year-end budget conversations. We're heading into Q4 planning cycles. If your board asks whether the threat is really getting worse, 1,073 victims in a single month is your answer. And the industrial sector concentration makes the case for OT security investment specifically.

Jordan: Which brings us to Ukraine. OpenAI and the Ukrainian government formalized a program called Daybreak to automate cybersecurity functions protecting power grids and water systems. This is happening in an active war zone under sustained Russian cyber operations.

Alex: This is significant for several reasons. It's one of the first state-level deployments of frontier AI models specifically for OT and critical infrastructure defense. Ukraine's infrastructure has been under constant Russian cyber and kinetic attack for years. So this isn't a proof of concept. It's a live proving ground against a sophisticated nation-state adversary.

Jordan: Every CISO responsible for critical infrastructure or OT environments should be tracking outcomes from Daybreak closely. Not because you're going to replicate it tomorrow, but because it will generate real data on what AI-assisted defense can and can't do against determined adversaries in OT environments. That intelligence will be transferable. And frankly, it'll also show us how Russia responds. Adversary adaptation to AI-driven defenses is something we have almost no empirical data on. We're about to get some.

Alex: Now let's shift to governance, because there are three stories today that together paint a very specific picture of where the regulatory landscape is heading. First, the EU Court of Auditors formally criticized the bloc's cross-border cyber incident response coordination, identifying structural information-sharing gaps between member states.

Jordan: This matters because NIS2 and DORA are live. The regulators are raising the bar for what they expect from private sector entities on information sharing and incident response, but the auditors are saying the public infrastructure to support that doesn't actually work yet. If you're a multinational operating in the EU, you're being held to standards that the governments themselves can't meet. That's the compliance environment.

Alex: Second, the Trump administration explicitly doubled down on a deregulatory posture toward AI, framing it as competitive necessity against China. This comes after a series of documented agentic AI security incidents.

Jordan: So we're in a world where AI-driven attacks are increasing, AI-driven defense is being deployed in war zones, and the U.S. government's position is that regulation would be a strategic mistake. I understand the competitive argument. I don't think it's wrong on its face. But for CISOs, the practical implication is clear. There will be no federal guardrails on AI deployment in the near term. Your internal governance program is the only governance program. If you haven't built one, you're operating without a net.

Alex: And that connects directly to our third governance piece. Cyber insurers are actively developing AI-specific policy language. They're trying to figure out how to characterize AI-initiated or AI-assisted attacks under existing coverage. CISOs should expect AI governance attestation requirements showing up in renewal questionnaires in the 2026-2027 underwriting cycle.

Jordan: This is the market filling the regulatory vacuum. When the government won't regulate, insurers will. And their incentives are actually pretty well aligned with good security outcomes because they're the ones writing the checks when things go wrong. So if you want to know what AI governance standards will look like in practice, watch what the underwriters require, not what Congress debates.

Alex: One more story before we close. Microsoft took down EvilTokens, a device-code phishing service that used AI at every stage of the attack chain. Fifty websites seized, 150 domains disabled, two arrests in the UK, 12,000 inboxes compromised.

Jordan: The cross-sector coordination here was notable. Microsoft, Health-ISAC, Cloudflare, Coinbase, OpenAI, SpyCloud, all participating in a coordinated takedown. That's the enforcement model that actually works. But the business model is what should concern you. Fifteen hundred dollars entry fee, five hundred a month subscription, distributed via Telegram. This is commodity infrastructure for sophisticated BEC and account takeover. The platform is gone. The architecture will be replicated within weeks.

Alex: So looking ahead, what's the through line today?

Jordan: The theme is convergence. State actors and criminal operators are exploiting the same infrastructure zero-days. AI is simultaneously the attack tool, the defense tool, and the governance gap. And the regulatory landscape is fractured, EU trying to coordinate and failing, U.S. explicitly stepping back, insurers trying to fill the void. CISOs are operating at the intersection of all of these forces.

Alex: Agreed. If I'm a CISO this week, I have three immediate priorities. Patch Check Point and F5. Audit any PeopleSoft exposure. And start the internal conversation about AI governance before your insurer forces it. Strategically, the budget case for 2027 is writing itself. Use the data.

Jordan: And hunt. Don't just patch. Hunt. The Check Point exploitation window goes back to July. The Chrome-Windows chain was active September 3rd and 4th. If you only patch forward, you're leaving adversaries already inside your environment.

Alex: That's our show for today. Show notes and links to every story we covered are at cleartext.fm. We'll be back tomorrow.

Jordan: Stay sharp.