Alex: Welcome to Cleartext. It's Wednesday, October 14th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: We have a packed show today. Ivanti zero-days hitting fully patched VPN appliances. North Korean IT workers infiltrating seventy-plus American companies. AI building a quarter-million-dollar Chrome exploit in six days. Drones taking out data centers. And a recording device hidden inside toilet paper at OpenAI. You can't make this up.

Jordan: Let's start with the one that should have every CISO on this call reaching for their phone. Volexity disclosed yesterday that a threat actor they're tracking as UTA0576 chained three zero-days in Ivanti Connect Secure to achieve root access on fully patched appliances. Fully patched. Version 22.8R2.4. The activity started the first week of October, so we're talking about roughly ten days of potential exposure before this went public.

Alex: And the critical detail here: Ivanti has patched two of the three vulnerabilities. The third fix is still pending. So even if you patched yesterday, you are not fully protected.

Jordan: Right. The exploitation chain included credential harvesting, configuration data exfiltration, and network reconnaissance. This is textbook initial access broker behavior. Get in, grab credentials, map the network, and either move laterally or hand off access to someone who will.

Alex: So what should CISOs be doing right now? First, if you're running Ivanti Connect Secure, treat this as an emergency regardless of your patch status. Apply the two available patches immediately if you haven't. Second, implement compensating controls around that third unpatched vulnerability. Segment those appliances. Increase monitoring on VPN infrastructure. Third, and this is the uncomfortable conversation, start scoping whether you need to do forensic analysis on your Ivanti environment going back to early October. If UTA0576 was in your network for ten days, credential harvesting and config exfiltration means the blast radius extends well beyond the VPN appliance itself.

Jordan: And I'll say what everyone's thinking. This is the third major Ivanti exploitation campaign in under three years. At some point, the conversation has to shift from incident response to architectural alternatives. If your perimeter depends on a product that keeps showing up in zero-day chains, your board should be asking whether that's an acceptable risk posture.

Alex: Agreed. And that segues nicely into our next story, because the threat landscape around exploit development just changed fundamentally. XBOW, a security research firm, used OpenAI's publicly available GPT-5.6 Sol model to build a full-chain Chrome exploit in six days. Three previously unknown vulnerabilities, chained together, achieving remote code execution when a user visits a web page. No other user interaction required.

Jordan: Six days. Using a model anyone can access. Google confirmed all three bugs, patched them, and paid XBOW two hundred and fifty thousand dollars. So this isn't theoretical. This is commercially validated.

Alex: The implication for CISOs is about timeline compression. Every vulnerability management program is built on assumptions about how long it takes for a disclosed vulnerability to become weaponized. Those assumptions just got obliterated. If a publicly available AI model can chain three zero-days into a working exploit in less than a week, your patch prioritization windows need to shrink accordingly.

Jordan: And this cuts both ways. XBOW used it for defense, for responsible disclosure. But the capability is symmetric. Offensive actors have access to the same models. The economics of exploit development just got dramatically cheaper, and the skill floor dropped through the floor.

Alex: This is a board-level conversation. The threat velocity is accelerating in ways that human-only security teams cannot match. It's one more data point in the argument for AI-augmented defense, which we'll touch on with the funding stories in a moment.

Jordan: Let's shift to the North Korea story, because Operation Lonestar Roundup is one of the most operationally significant law enforcement actions we've seen against state-sponsored cyber activity this year. DOJ charged fourteen individuals in connection with a North Korean remote IT worker scheme that infiltrated more than seventy U.S. companies. FBI raided over forty laptop farm locations across Texas and Ohio.

Alex: The scheme was structured and multi-layered. North Korean operatives used stolen American identities, and American facilitators operated the laptop farms domestically. The laptops would show up at a U.S. address, the facilitator would connect them to the network, and the North Korean worker would remote in from abroad. The companies thought they had a legitimate American employee working remotely. Approximately three million dollars was funneled back to Pyongyang.

Jordan: What makes this significant for CISOs is the maturity of the operation. This isn't a one-off. This is an industrialized process with division of labor, domestic infrastructure, and identity fraud at scale. Seventy-plus companies were compromised, and the FBI acknowledges this is likely a fraction of the total.

Alex: Every CISO listening should be asking their HR and IT teams three questions right now. One, what is our identity verification process for remote hires? If it relies on document submission and video interviews alone, it's insufficient. Two, do we monitor for anomalous remote access patterns, such as a laptop that's supposedly in Dallas but whose actual user is connecting from a different time zone or through unusual network paths? Three, have we done a retrospective review of remote hires made in the last twenty-four months against the indicators that FBI and CISA have published?

Jordan: And to be blunt, this isn't just a security problem. It's a sanctions compliance problem. If your company unknowingly employed a North Korean national and salary was routed to a DPRK-linked entity, you have an OFAC exposure. Legal and compliance need to be in the room for this conversation.

Alex: Let's talk about the Microsoft phishing disruption. Microsoft, Japan's National Police Agency, and Health-ISAC jointly seized domains for three major Chinese-language phishing platforms: YAM Store, CoGUI, and Iron Man. The numbers are staggering. More than one billion malicious messages sent to over seventy-five thousand organizations across a hundred and fifty countries in under ten months.

Jordan: The scale here is what matters. A billion messages. This is industrialized phishing-as-a-service, purpose-built for Chinese-language operators but targeting organizations globally. The kits enabled impersonation of major businesses and government entities with localized, convincing templates.

Alex: The action item is straightforward. Check your threat intelligence feeds for indicators associated with CoGUI, YAM Store, and Iron Man. Determine whether your organization was targeted. And recognize that domain seizures are disruptive but not permanent. These operators will reconstitute. The playbook is well-established.

Jordan: Now let's talk about something that should concern every CISO with workloads in a hyperscale data center region. Ukrainian drones struck three Yandex data centers in four days last week, disrupting Russian cloud services used by banks, telecoms, and the national railway.

Alex: And the reason this matters beyond the Russia-Ukraine context is the article's second point. Northern Virginia's Data Center Alley, which handles roughly seventy percent of global internet traffic, has the same physical vulnerability. Private data center operators have no legal authority to interdict drones. The FAA considers itself a safety regulator, not a security agency. There is a regulatory gap between the threat and the response capability.

Jordan: This is a resilience planning question. If your business continuity assumptions include geographic concentration in any single data center corridor, whether that's Northern Virginia, Dallas, or anywhere else, you need to model the scenario where that corridor experiences a physical disruption. Not just weather. Not just power. Kinetic disruption. It was theoretical eighteen months ago. It's operational reality in at least one theater of conflict now.

Alex: Two retail stories that connect thematically. First, hundreds of French supermarkets were hit by cyberattacks that manipulated industrial refrigeration controllers made by Dixell Electronics. The vulnerabilities had been publicly disclosed months before the attacks. Second, Ahold Delhaize USA, parent company of five major grocery chains, has had websites and apps offline for several days following a separate cybersecurity incident with no confirmed recovery timeline.

Jordan: The French supermarket story is significant because this is OT exploitation with direct physical consequences. Manipulating refrigeration systems means spoiled food, supply chain disruption, potential food safety incidents. And the vulnerabilities were known. This is a failure of OT patch management, which remains one of the hardest problems in enterprise security.

Alex: For CISOs in retail, manufacturing, logistics, anywhere with operational technology, the message is clear. OT asset visibility and patching are not optional anymore. These are not theoretical attacks. They're happening at scale against consumer-facing infrastructure.

Jordan: Quick detour to the insider threat story that reads like a spy novel. An OpenAI engineer, Abdulrahman Alfozan, a Saudi national, was arrested October ninth for allegedly planting a hidden recording device in an executive conference room. The FBI says the device was targeting discussions about OpenAI's superintelligence technology. He hid it inside toilet paper and plugged it into the back of a television.

Alex: Low-tech espionage against the highest-value AI intellectual property on the planet. This is a reminder that insider threat programs cannot be purely digital. Physical surveillance countermeasures, TSCM sweeps, access controls on sensitive meeting spaces, all of this matters, especially for organizations handling sensitive IP or operating in national security-adjacent domains.

Jordan: Two funding stories, and we'll keep these tight. Reach Security raised fifty million in a Series B for autonomous optimization of existing security controls. Their pitch is deterministic AI that remediates misconfigurations and disrupts multi-CVE exploit chains without deploying new tools. The thesis is compelling for CISOs drowning in tool sprawl who need to extract more value from what they already own.

Alex: And Pluto Security raised forty-two million to address the security risks from ungoverned enterprise AI adoption. Shadow AI is the new shadow IT, and it's moving faster. Employees using AI tools in unexpected ways are creating data exposure that traditional DLP and access controls weren't designed to catch. Both of these raises reflect where enterprise budget anxiety is concentrating right now: consolidation and AI governance.

Jordan: Looking at the week ahead, Alex, I think there's a theme emerging. The timeline between vulnerability and exploitation is compressing from every direction. AI is accelerating exploit development. Known OT vulnerabilities are being weaponized against physical infrastructure. Fully patched systems are falling to zero-day chains. The assumptions that underpin most security programs, patch windows, perimeter trust, even physical security models, are all under simultaneous pressure.

Alex: Agreed. And the North Korea and OpenAI stories add another dimension. The threat isn't just external and technical. It's internal, it's human, and it's operating at a level of sophistication that demands integrated security thinking. Identity verification, insider threat, physical security, OT visibility, AI governance, these are not separate programs anymore. They're facets of the same risk surface. CISOs who are still managing these in silos are going to find out the hard way that the adversaries aren't.

Jordan: Well said. That's our show for today.

Alex: Thanks for listening to Cleartext. Show notes and links to every story we covered are at cleartext.fm. We'll see you tomorrow.