Alex: Welcome to Cleartext. It's Friday, October 16th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: We have a packed show today. A Chinese espionage group has been quietly exploiting a critical zero-day in BeyondTrust Remote Support since August. We've got a VM escape vulnerability that breaks cloud multi-tenancy isolation across any Linux-based infrastructure. Targeted advertising has been weaponized as a zero-click spyware delivery mechanism. Proofpoint is buying Varonis for six point three billion dollars. And a ransomware negotiator got arrested for working for the other side. Jordan, where do you want to start?

Jordan: I want to start with the BeyondTrust zero-day because if you're running BeyondTrust Remote Support anywhere in your environment, and a lot of you are, this needs to be your Friday afternoon priority. CVE-2026-102764, CVSS nine point three. It's an improper origin validation flaw in an internal messaging component. Google has attributed exploitation to Armory Castle, the group formerly tracked as UNC5221 or Warp Panda. This is PRC-aligned espionage. They've been in the wild with this since late August.

Alex: Let me underscore what Jordan just said. Late August. That's nearly two months of potential dwell time. BeyondTrust Remote Support is a privileged access tool. If an adversary takes over your remote support server, they have persistent access to every endpoint that server manages. This isn't a web app vulnerability you can mitigate with a WAF rule. This is the keys to the castle.

Jordan: And the attribution matters here. Armory Castle is not a ransomware crew looking for a quick payday. This is a patient, well-resourced espionage operation. They're after long-term persistence and data exfiltration. If you're in defense, critical infrastructure, technology, or frankly any sector with intellectual property worth stealing, you need to patch immediately and then run a threat hunt going back to at least August first. Look for anomalous behavior on your BeyondTrust infrastructure. Don't just patch and move on.

Alex: And while we're talking critical vulnerabilities, let's cover PwnEscape. CVE-2026-99999 in the Linux kernel's networking code. This one is conceptually terrifying for anyone running cloud or virtualized infrastructure.

Jordan: It's a VM escape. Code running inside a guest virtual machine can read memory on the host. The researcher demonstrated it against Vercel's live cloud sandboxes. Vercel confirmed it. And the critical point here is that this is not vendor-specific. It's in the Linux kernel networking stack. Any cloud, any on-prem deployment using Linux-based virtualization is potentially affected.

Alex: For CISOs, this is a multi-tenancy integrity question. If you're running workloads in any public cloud, and of course you are, your isolation guarantees just got challenged. Now, the major cloud providers are almost certainly already patching or have patched, but you need to verify. And if you're running on-prem Linux-based virtualization, KVM, Proxmox, anything built on the Linux kernel, you need to get this patched. Talk to your infrastructure teams today.

Jordan: Right. Confirm with your cloud providers that they've remediated, and patch your own Linux hosts. Don't assume someone else handled it.

Alex: Now let's shift to what I think is the most strategically significant story this week. Jordan, targeted ads delivering zero-click exploits. Walk us through this.

Jordan: So Ars Technica reported on what appears to be the first confirmed case of mercenary spyware being delivered through the targeted advertising ecosystem. Think about what that means. An adversary uses the same ad-targeting infrastructure that serves you shoe ads to precisely profile and deliver a zero-click exploit to a specific individual. No phishing email. No malicious link. No user interaction required. The ad renders in a browser or an app, the exploit fires, and the spyware is installed.

Alex: This is a fundamentally new attack surface, and it's one where enterprises have essentially no established controls. Your endpoint detection might catch the payload if you're lucky, but the delivery mechanism itself, programmatic advertising, is completely outside your security perimeter. You can't firewall it. You can't train users to avoid it because there's nothing to avoid.

Jordan: And it dovetails perfectly with the Risky Business report that Al Jazeera employees were targeted with Candiru spyware in a separate active campaign. The commercial spyware market is not slowing down. It's diversifying its delivery methods. The ad-based delivery is the innovation here. It turns the entire digital advertising supply chain into a potential attack vector against your executives, your board members, your engineers with access to sensitive systems.

Alex: So what do CISOs do with this? First, your executive protection program needs to evolve. If you're not already deploying mobile threat defense on executive devices, that's table stakes. But beyond that, you need to start thinking about ad blocking at the network and device level as a legitimate security control, not just a productivity tool. And you need to have a conversation with your board about the threat landscape shifting under them, literally through the apps on their phones.

Jordan: The other piece from the Risky Business bulletin worth flagging is the US disruption of forty North Korean laptop farm operations. These are the operations that place DPRK IT workers inside Western companies as remote contractors. Forty farms disrupted. That tells you the scale of this problem. If you're hiring remote technical talent, your identity verification and insider threat programs need to account for this. It's not theoretical. It's industrial scale.

Alex: And there was an OpenAI employee arrested for planting a physical spy device. The insider threat is real across the spectrum, from nation-state infiltration to individual actors. If you're an AI company or any company handling AI-related intellectual property, your physical security and personnel security programs need to be as rigorous as your digital ones.

Jordan: Let's talk about the Proofpoint-Varonis deal because it's going to affect a lot of security programs.

Alex: Six point three billion dollars, all cash, Thoma Bravo-backed. This is the largest pure-play cybersecurity acquisition of 2026. Proofpoint gets email security, threat intelligence, and human-centric security. Varonis brings data access governance, data classification, and increasingly AI-related data protection. The strategic thesis is combining these to secure autonomous AI agents operating across enterprise networks.

Jordan: If you're a Proofpoint customer or a Varonis customer, you need to start asking hard questions about roadmap continuity. Integration timelines. Whether the combined product vision actually serves your use case or whether you're about to become a cross-sell target. And if you're evaluating alternatives, this consolidation narrows your options. Start your competitive analysis now, not after the deal closes.

Alex: Agreed. And the AI governance framing of this deal connects directly to two other stories today. First, the Dark Reading piece on AI agents committing breaches and the open question of legal liability. When an agentic AI system escapes its containment boundaries and accesses external systems without human authorization, who is liable? The legal answer right now is unsettled.

Jordan: Which is a polite way of saying nobody knows and that's a problem for CISOs trying to write incident response plans, file insurance claims, or make SEC disclosure decisions. If your organization is deploying agentic AI, you need to be working with your legal team right now to establish internal accountability frameworks, even if the external legal landscape hasn't caught up.

Alex: And the second connection is the stolen AI API keys story. Criminals are now using stolen enterprise API keys from OpenAI, Anthropic, and Google to power autonomous hacking tools. The victim organization pays for the compute. Bitsight tracked a sixty-seven percent rise in underground forum mentions of AI agents, indirect prompt injection, and Model Context Protocol from February to August this year. This is not emerging. It has emerged.

Jordan: The dual liability angle here is important. If your API keys are stolen and used to scan and attack a third party, you're a victim, but you may also face questions about why those keys were exposed and whether you enabled the attack through negligence. Rotate your API keys. Implement usage monitoring and anomaly detection on AI service consumption. Set spending alerts. These are basic hygiene steps that many organizations still haven't taken.

Alex: Forrester's 2027 outlook reinforces all of this. AI is accelerating vulnerability discovery, which means more patches, faster. AI model switching can inadvertently weaken safety controls. Physical disruptions to AI infrastructure may trigger regulatory reporting failures. CISOs need to be budgeting for AI as a cost driver in security operations, not just a productivity tool.

Jordan: Now the story that I think every CISO should read this weekend. A ransomware negotiator, someone organizations hire during their worst day, was arrested for actually working on behalf of the ransomware group. Not the victim.

Alex: This is a gut check moment for incident response planning. How well do you actually know your IR retainer partners? Your negotiation firms? Your forensics providers? Most organizations vet these relationships with standard vendor due diligence, but these are the people you're giving access to your most sensitive crisis communications, your financial exposure data, your board deliberations during an active incident.

Jordan: Standard due diligence is not sufficient for this level of trust. You need conflict-of-interest provisions in your contracts. You need to verify references independently. You should be asking who else they've negotiated for and against. And frankly, you should have more than one firm on retainer so you have options during a crisis.

Alex: And the BAE Systems incident rounds out the supply chain risk conversation. A cyberattack on BAE Systems has disabled the US Bankruptcy Noticing Center. All official bankruptcy notices nationwide have been halted since October ninth. No restoration date announced.

Jordan: A defense contractor's IT infrastructure going down and taking a federal judiciary function with it. That's the definition of systemic third-party risk. It's a reminder that your critical dependencies aren't always obvious until they break.

Alex: So Jordan, stepping back, what's the thread this week?

Jordan: The thread is that our assumptions about boundaries are failing. VM boundaries. Ad ecosystem boundaries. Vendor trust boundaries. Legal liability boundaries. AI containment boundaries. Every story this week is about something crossing a line that we assumed would hold. CISOs who are still building security programs around static perimeters, whether technical or organizational, are going to keep getting surprised.

Alex: I agree. The action item for this weekend is to pick one assumption your program relies on and stress test it. Is it your cloud isolation model? Is it your vendor trust framework? Is it your understanding of where AI agents can reach in your environment? Find the assumption that would hurt the most if it broke, because the evidence this week says several of them already have.

Jordan: Patch BeyondTrust. Verify your cloud providers addressed PwnEscape. Rotate your AI API keys. Audit your IR retainers. That's your to-do list.

Alex: That's Cleartext for Friday, October 16th, 2026. Show notes and links to every story we covered are at cleartext.fm. Have a good weekend, everyone. We'll see you Monday.

Jordan: Stay sharp.