Alex: Good Monday morning. It's October 26th, 2026, and this is Cleartext. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Alex: We have a packed show today. Two critical vulnerability families are being actively exploited in the wild, one of them with suspected North Korean scanning activity, so we'll get to those quickly. We're also going to dig into a Microsoft 365 token-replay campaign that hit 79 organizations, a supply-chain attack on an AI orchestration tool that caught tens of thousands of users, and a deeply uncomfortable finding about dormant AI agents sitting in your environment with live credentials that nobody's watching. Then we'll talk about CISA's new four-year strategy, the UK pushing new laws on undersea cable protection, and some consolidation moves that should be on every CISO's radar. Let's get into it.

Jordan: Let's start where the hair's on fire. If you're running PHP-based web infrastructure, and statistically most of you have it somewhere, you need to be patching right now. Two critical RCE vulnerabilities, CVE-2026-109618 and 109619, collectively tracked as PHP2Shell, are confirmed exploited in the wild. Palo Alto's Unit 42 has observed post-compromise activity at a European government agency. And the scanning is global, attributed to suspected North Korean threat actors. This is not theoretical. This is active exploitation against real targets.

Alex: And this connects directly to the second vulnerability story. There's a critical memory corruption flaw in the Brotli C decoder library that's embedded in Node.js, being tracked under various names, HTTP2Shell, Node2Shell, Broccoli2Shell depending on the vendor. Microsoft pushed emergency out-of-band patches for .NET over the weekend. The Brotli flaw enables remote code execution and sensitive data access. When you see Microsoft issuing out-of-band patches on a weekend, that tells you everything about the severity.

Jordan: Right. And the North Korean scanning infrastructure that Unit 42 flagged for PHP2Shell overlaps with scanning activity observed against Node.js targets. So what we're likely looking at is a coordinated campaign probing multiple runtime environments simultaneously. If your vulnerability management team isn't already triaging both of these, pull them in this morning. This is your emergency patch event for the week, possibly the month.

Alex: Action items are straightforward. Identify all PHP and Node.js instances across your environment, including the ones buried in legacy apps that nobody wants to own. Prioritize internet-facing systems. And make sure your detection teams are looking for the post-compromise indicators Unit 42 published. Let's move on.

Jordan: The Microsoft 365 token-replay campaign is a different animal but no less concerning for its implications. Huntress documented 497 successful M365 sign-in events across 97 accounts at 79 organizations between July and September. The technique is adversary-in-the-middle relay. The attacker sits between the user and Microsoft's authentication endpoint, captures the active session after MFA completes, and replays the stolen token. MFA is completely bypassed. It doesn't matter if you're using push notifications, TOTP, SMS. The session is captured post-authentication.

Alex: This is the conversation I've been having with boards for two years. MFA is necessary but not sufficient. When I say that, I sometimes get blank stares because the board heard three years ago that MFA was the answer. Now I have to explain that the answer has an expiration date. The mitigation here is phishing-resistant MFA, specifically FIDO2 hardware keys or passkeys, combined with Conditional Access policies that enforce token binding and limit token lifetimes. If you're still running 14-day refresh token windows on privileged accounts, you're essentially leaving the door propped open.

Jordan: The ten-week duration of this campaign is the part that should bother CISOs most. This wasn't a smash-and-grab. This was persistent, scalable, and methodical. Seventy-nine organizations means this threat actor has industrialized the process. If your M365 environment hasn't been audited for token hygiene recently, add it to this week's list right after the PHP and Node.js patches.

Alex: Now let's talk about two stories that together paint a really uncomfortable picture of the AI supply chain. First, LiteLLM. For those unfamiliar, it's an open-source tool widely used by AI developers to integrate multiple LLM APIs into enterprise applications. Last week, a supply-chain attack hit tens of thousands of LiteLLM users. The root cause was a key that was accidentally exposed back in May and never revoked. Five months of exposure before it was weaponized.

Jordan: Five months. That's the number that should make every security leader wince. And it's a perfect illustration of something we keep saying: AI tooling carries the same credential hygiene risks as traditional software dependencies, except the adoption velocity is ten times faster and the governance is ten times weaker. Your developers are pulling LiteLLM into production because it solves a real integration problem, but nobody's running the same third-party risk assessment on it that they'd run on a traditional SaaS vendor. The tool has broad access to your LLM API keys, your model configurations, potentially your training data pipelines. One unrevoked key and all of that is exposed.

Alex: And this connects directly to the Arrakis Security research on dormant AI agents. Seventy-six percent of enabled AI agents in production environments had not executed in 60 days but still retained active credentials and system connections. These agents can read data, write data, invoke tools, trigger workflows. They are, for all practical purposes, service accounts with broad privileges that nobody is reviewing.

Jordan: Your PAM solution doesn't know about them. Your quarterly access review doesn't cover them. They exist in a governance gap that most organizations haven't even identified yet, let alone closed. And the attack surface is material. If an adversary compromises a dormant agent's credentials, they inherit whatever access that agent was provisioned with, and nobody notices because the agent hasn't been active in months. There's no baseline to alert against.

Alex: My recommendation: treat this as an identity governance problem. Extend your access review processes to cover autonomous agents explicitly. Implement automated deprovisioning for agents inactive beyond a defined threshold, 30 days, 60 days, whatever fits your risk tolerance. And start inventorying what agents are deployed, what they can access, and who owns them. Most organizations cannot answer those three questions today.

Jordan: Now the Gheist campaign. This one targets GitHub, specifically private repositories and GitHub Enterprise environments. Attackers are using stolen tokens to plant malicious workflows that print repository secrets into GitHub Actions logs. They download the logs, then delete the evidence. Wiz confirmed that this has successfully compromised private repositories, and it bypassed a GitHub safeguard that was supposed to pause suspicious activity.

Alex: If your development teams use GitHub Actions, and most do, you need to audit token hygiene immediately. Review which tokens have write access to workflows, ensure you're rotating tokens on a defined schedule, and look at your Actions log retention policies. The fact that attackers are deleting run evidence means your forensic window is limited. If you're not shipping Actions logs to an immutable external store, you may never know you were hit.

Jordan: Let's shift gears to the macro picture. CISA published its 2030 strategy, and the framing is notable. Three pillars: defend, harden, prevail. The language explicitly signals a shift from passive defense to what they're calling an aggressive, anticipatory posture.

Alex: For CISOs at critical infrastructure organizations, this is the document that will shape federal engagement for the next four years. Read it closely. The implication is higher baseline expectations, more active federal involvement during incidents, and new benchmarking frameworks that your regulators will eventually reference. If you're in financial services, energy, healthcare, or telecommunications, expect this strategy to trickle down into sector-specific guidance within twelve to eighteen months.

Jordan: And on the geopolitical front, the UK is proposing crisis powers that would let ministers direct cable operators during emergencies, plus up to 14 years imprisonment for undersea cable sabotage. Security analysts are urging the US to follow suit, noting that American undersea cable law literally dates to 1888.

Alex: The criminal penalties are largely symbolic when the threat actors are nation-states. Russia and China are not deterred by the prospect of prosecution in British courts. But the crisis powers are substantive. The ability for government to direct cable operators during an incident changes the operational calculus for any organization with cross-border data dependencies. If you're a global enterprise routing critical data across submarine cables, and that's most large financial institutions and technology companies, you need to incorporate subsea infrastructure risk into your resilience planning. This is no longer an edge case.

Jordan: Quickly on the M&A front. Two stories worth flagging. Datadog is reportedly in talks to acquire cloud security startup Upwind for approximately four billion dollars. If that goes through, it collapses cloud observability and runtime security into a single platform and intensifies competition with Wiz, Orca, and Palo Alto's Prisma Cloud. If you're mid-evaluation on CNAPP tooling, this deal could reshape your shortlist.

Alex: And the broader trend is even more interesting. Workday acquired C1.ai for identity governance. Cohere bought Aisle. OpenAI is reportedly in talks to acquire Trail of Bits. These are not security companies. These are HR platforms and AI labs buying security startups. If you've built your security architecture around an independent startup that gets acquired by a non-security platform vendor, your roadmap assumptions just changed. Vendor independence risk is real, and it's accelerating.

Jordan: So looking at the week ahead, the theme I keep coming back to is the velocity gap between adoption and governance. AI agents deployed without lifecycle management. AI orchestration tools adopted without third-party risk assessment. Development pipelines running on tokens that nobody rotates. Every one of today's stories is fundamentally about organizations moving faster than their controls can keep up.

Alex: Agreed. And the regulatory environment is catching up. CISA 2030, the UK cable legislation, the consolidation of security capabilities into non-traditional vendors, all of it points toward a world where CISOs are going to be held accountable for risks they may not even have visibility into yet. The homework this week is unglamorous but essential. Patch PHP and Node.js. Audit your M365 token policies. Inventory your AI agents and their credentials. And start pressure-testing your assumptions about vendor independence. The organizations that get ahead of these governance gaps now will be the ones that aren't scrambling when the next incident hits.

Jordan: Well said. That's your Monday, folks.

Alex: That's Cleartext for October 26th, 2026. Show notes and links to every story we covered are at cleartext.fm. We'll be back tomorrow. Stay sharp.