Alex: Welcome to Cleartext for Friday, October 23rd, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. So, a China state-aligned threat actor just used an open-source agentic AI framework to automate intrusions across more than 2,250 customer tenants through a ConnectWise supply chain compromise. At machine speed. Not a hundred targets. Not five hundred. Twenty-two hundred and fifty. If you're not rethinking your assumptions about adversary velocity right now, you're already behind.

Alex: That is our lead story today and it deserves real time. We're also covering a session token replay campaign that breached 79 organizations without a single password, a ransomware group that used one supply chain compromise to hit 40 shipping companies simultaneously, Quest Diagnostics disclosing a breach of a system used by thousands of healthcare providers, and a certificate authority that generated a private key that was literally the number four. Plus Meta's $25 billion penalty, a VeloCloud zero-day you need to patch today, and the AI supply chain compromise that should worry anyone running LiteLLM. Let's get into it.

Jordan: So let's unpack the Storm-0940 story because this is genuinely a phase change. Microsoft formally attributed this ConnectWise supply chain compromise to a China-aligned actor, Storm-0940, and what makes this different from every supply chain attack we've discussed before is the operational layer. They used Artex, which is an open-source agentic AI framework, to automate credential attacks across those 2,250-plus tenants. This isn't a human operator running scripts. This is an autonomous agent making decisions about lateral movement, about which credentials to try, about how to abuse trusted cloud applications to avoid detection. The agent is the operator.

Alex: And that's the part that should fundamentally change how CISOs model threat scenarios. We've been talking about AI-augmented attacks for two years now, and most of what we've seen has been AI helping with phishing lures or code generation. This is different. This is agentic AI handling the actual intrusion chain. The adversary sets the objective, the agent executes across thousands of targets simultaneously. Your security operations center is built to handle human-speed adversaries. What happens when the attacker can probe, pivot, and persist across your entire tenant in the time it takes your analyst to open a ticket?

Jordan: And the supply chain element compounds this. They didn't need to find 2,250 individual vulnerabilities. They compromised ConnectWise once and then unleashed the agent across the entire customer base. The fact that they abused trusted cloud applications for lateral movement means your allow-lists, your OAuth trust relationships, your assumption that traffic from a known SaaS provider is benign — all of that becomes attack surface.

Alex: The practical takeaway here: if you're a ConnectWise customer, you should already be in incident response mode working with Microsoft's indicators. But more broadly, every CISO needs to pressure-test their detection stack against autonomous, multi-tenant attacks that operate through trusted application channels. Your SIEM correlation rules were not written for this.

Jordan: Let's stay on supply chain attacks because today is honestly a masterclass in why this vector dominates everything. A ransomware group used a single supply chain compromise to breach approximately 40 shipping companies simultaneously. Risky Business reported this alongside the Pentagon announcing a technology sabotage unit, which tells you something about the strategic temperature right now. But the shipping attack is the one with immediate enterprise relevance. Sector-specific software vendors, the ones that serve a vertical like maritime logistics, they create systemic concentration risk. You compromise one vendor, you own the sector.

Alex: And then we have LiteLLM, which is the third supply chain story today. Attackers compromised the PyPI release pipeline for LiteLLM and published malicious Docker images containing info-stealer payloads. LiteLLM is the open-source library that a huge number of enterprises use to unify access across multiple LLM providers. If you've integrated it into your AI infrastructure, which many AI engineering teams have done without necessarily going through full security review, the malware is targeting exactly what you'd expect: credentials, API secrets, environment variables. The crown jewels of your AI deployment.

Jordan: This is the AI supply chain risk we've been warning about. AI teams move fast, they pull open-source packages, they containerize everything, and the security review process often hasn't caught up. If LiteLLM is in your stack, verify your package integrity today. Check your Docker image hashes. And frankly, use this as the forcing function to get your AI infrastructure under the same supply chain governance as your production applications.

Alex: Let's pivot to the Microsoft 365 session token replay campaign because this one is elegant and deeply concerning. Huntress tracked this over ten weeks, July 14th through September 22nd. An attacker replayed stolen session tokens to achieve 497 successful sign-ins across 79 organizations. No passwords. MFA was completely irrelevant because they never went through an authentication flow. They showed up with a valid session.

Jordan: And then the tradecraft after initial access was textbook persistence. They planted hidden inbox rules so victims couldn't see portions of their own email. You're compromised, and your mailbox is actively hiding evidence of the compromise from you. The attacker attempted over 200,000 logins total, so the success rate was low, but 497 successful entries across 79 organizations is more than enough to cause serious damage.

Alex: The action item here is specific. Review your conditional access policies. Are you enforcing token binding? What are your session token lifetimes? Are you monitoring for anomalous token reuse from unexpected locations or devices? Most organizations set up MFA and consider authentication solved. This campaign proves that MFA is necessary but not sufficient. Token hygiene is now a primary control.

Jordan: Moving to healthcare. Quest Diagnostics filed an SEC disclosure confirming a breach of its Quanum LSM system. This is the platform healthcare providers use nationwide to order lab tests and retrieve results. Quest confirmed that certain patient records were likely compromised.

Alex: This is the third or fourth major healthcare technology breach this year, and the pattern is consistent. It's not the hospitals themselves getting breached. It's the shared technology platforms they all depend on. Quanum LSM is infrastructure for thousands of providers. One compromise, cascading impact across the healthcare ecosystem. If you're a healthcare CISO, your third-party risk program for clinical systems needs the same rigor you apply to your EHR vendor. These lab integration platforms are often treated as utilities and reviewed accordingly, which is to say, not rigorously enough.

Jordan: Now for a story that's almost comedic if the implications weren't so serious. Indian certificate authority eMudhra was generating private keys so weak that researchers cracked them in under one second. One of the private keys was the integer four. Just the number four. eMudhra has now exited the certificate business entirely.

Alex: I want to be precise about why this matters beyond the absurdity. Certificate authorities are trust anchors. Every browser and operating system on your network trusts a set of CAs, and you probably haven't audited which ones in a while. eMudhra was in those trust stores. Scott Helme published the research, revocation processes are underway, but the broader lesson is about CA diversity and dependency mapping. How many CAs does your organization rely on? What happens if one gets revoked? Do you have certificate chain visibility across your infrastructure?

Jordan: And GoDaddy is simultaneously revoking 400,000 certificates due to a separate issue, so if you haven't stress-tested your certificate lifecycle management recently, October 2026 is giving you multiple reasons to do so.

Alex: Let's talk about the Meta ruling. A New Mexico court ordered Meta to pay $25 billion after finding 43 million individual privacy violations tied to Cambridge Analytica. State District Court Judge Francis Mathew established what could become significant precedent for per-violation penalties at the state level.

Jordan: Twenty-five billion. With a B. Even if this gets reduced on appeal, the framework matters. A court calculated penalties on a per-violation basis across 43 million instances. If you're a CISO at any organization with large-scale consumer data, your general counsel is going to want to understand your exposure under this framework. How many records do you hold? What's your data sharing posture with third parties? Multiply by the per-violation penalty this court applied, and the number gets existential very fast.

Alex: This changes how boards evaluate data governance risk. It's no longer theoretical. There is now a judicial precedent that says data misuse at scale can generate penalties that threaten the enterprise.

Jordan: Quick hit on Arista VeloCloud. There's an actively exploited zero-day SQL injection in VeloCloud Orchestrator. Any authenticated user, even a read-only customer account, can escalate to full operator privileges. This is your SD-WAN management plane. If you run VeloCloud, patch today. Not Monday. Today.

Alex: Brief note on the market. Datadog is reportedly eyeing a $4 billion acquisition of cloud security startup Upwind, which is also fielding a $300 million growth investment from Bessemer. If you're evaluating cloud security architecture and vendor consolidation, this potential deal would merge observability and runtime defense into a single platform. Worth tracking for roadmap planning, but don't make purchasing decisions based on rumored M&A.

Jordan: And on the legislative front, a bipartisan bill would direct NIST to develop federal guidance on AI model distillation attacks. This is early-stage, but it's the first concrete legislative signal that distillation, where adversaries replicate proprietary models at a fraction of the cost, is going to become a compliance concern. If you're developing or fine-tuning models, put this on your regulatory watch list.

Alex: So Jordan, stepping back and looking at this week, three separate supply chain compromises, agentic AI automating nation-state operations, session tokens rendering MFA irrelevant, a certificate authority generating the number four as a private key. What's the theme?

Jordan: The theme is that the trust assumptions baked into our security architectures are being systematically dismantled. We trust our software supply chain. We trust our session tokens. We trust our certificate authorities. We trust that adversaries operate at human speed. Every one of those assumptions took a hit this week. The organizations that will be resilient are the ones that architect for trust failure, not just trust verification.

Alex: I'd add that the velocity dimension is new and real. Storm-0940 using agentic AI to simultaneously exploit 2,250 tenants isn't an incremental improvement. It's a category change. Next week, I expect we'll see more details on the ConnectWise IOCs and I'd watch for whether other threat actors adopt the same open-source Artex framework. If this playbook works for Storm-0940, it's going to proliferate.

Jordan: Agreed. And watch the VeloCloud situation. Actively exploited zero-days in SD-WAN management planes have a way of getting worse before they get better.

Alex: That's our show for Friday, October 23rd. Show notes and links to every story we covered are at cleartext.fm. Have a good weekend. Patch your VeloCloud. Check your session token policies. And maybe audit your certificate authorities while you're at it.

Jordan: See you Monday.