Alex: Good morning. It's Wednesday, October 28th, 2026. This is Cleartext. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: We have a packed show today. Volt Typhoon has a new trick that makes your IOC feeds essentially decorative. The insurance industry is sounding alarms about PHP2Shell as a potential systemic loss event. The UK government just put software vendors on notice about breach liability. NIST gave us a hard deadline for post-quantum migration. We've got active exploitation alerts from CISA, a chained Oracle zero-day that's been burning for months, and a couple of funding rounds that tell you where the market thinks security budgets are heading. Let's start where we should start, which is with Volt Typhoon.

Jordan: So Black Lotus Labs published research this morning on what they're calling Silent Train. This is Volt Typhoon's new operational infrastructure framework, and I want to be direct with you: this is the most significant evolution in Chinese cyber tradecraft I've seen in the last two years. The concept is ephemeral relay networks built on compromised devices, routers, IoT, edge infrastructure, that rotate so rapidly that by the time you've identified a malicious IP, it's already been swapped out of the chain. They've used this to penetrate hundreds of critical infrastructure networks.

Alex: And the reason this is a ten out of ten for our audience is that it doesn't just evade your threat intel feeds. It fundamentally breaks the detection model that most enterprises have built their network defense around. If you're relying on IP-based blocking, domain reputation, conventional IOC matching, you are not seeing this activity.

Jordan: That's exactly right. The rotation cadence is fast enough that even automated enrichment pipelines can't keep up. You're chasing ghosts. The implication for CISOs, especially those in energy, water, telecom, transportation, is that you need to shift your detection philosophy toward behavioral analytics and anomaly detection at the network edge. You're looking for patterns, not signatures. You're looking for traffic that behaves like command and control even if the endpoints are brand new to you.

Alex: And this is a board conversation. If you're a critical infrastructure CISO and your board still thinks nation-state threats are abstract, this is the briefing material you bring. Volt Typhoon is pre-positioning for disruption. That's not speculation. That's the assessed intent. The question for your organization is whether your detection architecture can see activity that's specifically designed to be invisible to your detection architecture.

Jordan: And if the answer is no, that's a budget conversation, not a tuning conversation.

Alex: Let's pivot to something directly connected, which is the insurance angle. Cybersecurity Dive is reporting that the insurance industry is flagging PHP2Shell as a potential systemic loss event. For those tracking this, PHP2Shell exploits web management interfaces on firewalls, VPNs, and application delivery controllers, the exact perimeter infrastructure that Silent Train would be tunneling through.

Jordan: Right, and the insurance angle here matters because the carriers are essentially saying their risk models can't absorb a correlated event at this scale. We're talking about billions in potential claims. When your insurer is publicly worried, that's a signal.

Alex: It's more than a signal. It's a call to action. If you haven't talked to your broker in the last 30 days, you're behind. Underwriters are going to start adjusting terms, tightening exclusions, potentially adding sublimits for systemic cyber events. The time to understand your policy exposure is before your renewal, not during it. And if you're running any of the affected perimeter appliances, your insurer may start asking pointed questions about your patch posture and your compensating controls.

Jordan: Get ahead of those questions.

Alex: Now, staying on governance and liability, there's a significant development out of the UK. The new budget explicitly states the government will, quote, consider where liability for cyber breaches should sit, unquote. This is a potential sea change. The UK has historically relied on voluntary codes to encourage software vendors to improve security. This is the government saying that voluntary isn't working.

Jordan: And look, we've been talking about the inevitability of this for years. The US has nudged in this direction with the National Cybersecurity Strategy, but the UK may actually legislate first. If they shift liability onto software vendors, every contract you have with a UK-based vendor or any vendor selling into UK markets gets reopened.

Alex: For CISOs, the immediate action is awareness. But the medium-term action is real. You should be inventorying your software supply chain for UK exposure. You should be talking to your legal and procurement teams about contract language that anticipates this shift. And frankly, even if you have zero UK exposure, this is the direction of travel globally. The era of vendors shipping insecure code and leaving the risk with the buyer is ending. It's just a question of how fast.

Jordan: I'd add one thing. This also changes the CISO's leverage in vendor negotiations. If your vendor knows they may be liable for their own bugs, they're going to be a lot more responsive to your security requirements during procurement.

Alex: Good point. Let's talk about NIST and post-quantum. The new guidance sets a hard 2035 cutoff for quantum-vulnerable public-key algorithms. They're allowing hybrid approaches during the transition, classical and quantum-resistant algorithms running in parallel, and they've identified network encryption as the top priority for early migration.

Jordan: 2035 sounds far away. It isn't. If you're running legacy systems, mainframes, embedded OT, older PKI infrastructure, the migration timeline for those environments is measured in years, not months. The inventory work needs to start now if it hasn't already.

Alex: And the hybrid approach is pragmatic. NIST is acknowledging that this is not a rip-and-replace scenario. But the key takeaway for CISOs is that you now have a firm planning horizon. Your board should know that this is a multi-year capital investment, not an annual budget line item. If you don't have a cryptographic inventory today, that's your first deliverable.

Jordan: And don't forget harvest-now-decrypt-later. Nation-states are already collecting encrypted traffic for future decryption. If you're in government, defense, financial services, pharma, the urgency is higher than the 2035 date suggests.

Alex: Let's move to the active threats. CISA confirmed active exploitation of the Brotli vulnerability, the one being called Node2Shell, Broccoli2Shell, HTTP2Shell, depending on who you ask. It affects the Google Brotli decoder library with broad web infrastructure and e-commerce exposure. CISA added related Adobe Commerce and Brotli CVEs to the Known Exploited Vulnerabilities catalog.

Jordan: This is straightforward. If you're running Adobe Commerce or any web infrastructure that uses the Brotli decoder, this is an emergency patch. Don't wait for your next cycle. The exploitation is confirmed and active. Check your exposure, patch, validate.

Alex: And on Oracle PeopleSoft, The Hacker News is reporting that the zero-day ShinyHunters has been exploiting since May is actually three chained vulnerabilities: SSRF, internal loopback trust abuse, and an escalation flaw, all patched under a single CVE in June. The concern is that Oracle's single-CVE approach may have masked the full attack surface and given organizations a false sense that one patch covered one problem.

Jordan: If you're running PeopleSoft, you need to verify that June patch was applied. And more importantly, you need to do retroactive compromise assessment going back to at least May. ShinyHunters had months of access. The patch closes the door, but it doesn't tell you if someone's already inside.

Alex: Exactly. Don't just patch. Hunt.

Jordan: Let's hit the healthcare breach quickly. UNM Health Sciences Center, ransomware, surgeries disrupted, patient care affected. This is the scenario that keeps healthcare CISOs up at night and it keeps happening.

Alex: And every time it happens, the regulatory and board scrutiny intensifies. If you're in healthcare, your operational resilience plan needs to account for clinical workflow continuity, not just IT recovery. The question isn't whether your systems come back online. It's whether patients receive care while they're down.

Jordan: Let's do the funding rounds quickly. Upwind raised 400 million in Series C, total funding now over 800 million. Bessemer led. The platform targets AI security across endpoints, code, and cloud.

Alex: 800 million in total funding tells you where the institutional money sees the next platform category forming. Runtime cloud security and AI workload protection. If you're evaluating your cloud security architecture, Upwind is now firmly in the conversation alongside the incumbent CNAPP vendors.

Jordan: And Mave, a Tel Aviv startup, raised 34 million for AI models purpose-built for SOC workflows. Their thesis is that general-purpose LLMs are too expensive and too noisy for specialized security operations.

Alex: I think that thesis is correct, and I think we'll see more of this. The SOC of the future isn't going to run on ChatGPT. It's going to run on domain-specific models trained on security telemetry. Whether Mave is the one that gets there is a different question, but the direction is right.

Jordan: Agreed. Watch this space.

Alex: One more item before we close out. Anthropic's IPO filing is worth reading if you're evaluating AI foundation model providers. The risk disclosures are unusually candid. They explicitly acknowledge risks including out-of-control AI, model misuse, and infrastructure security threats. And they say the quiet part out loud: profit incentives may shape safety decisions.

Jordan: This is actually useful for CISOs. Most vendor risk assessments for AI providers are built on questionnaires and marketing materials. Anthropic just gave you a SEC-mandated honest assessment of their own risk profile. Use it as a benchmark. Ask your other AI vendors why their risk disclosures aren't this transparent.

Alex: Smart move. Use their candor as leverage.

Jordan: So stepping back, what's the theme today?

Alex: I'd say it's the collapse of comfortable assumptions. The assumption that IOC feeds will catch nation-state actors. The assumption that your cyber insurance will cover a systemic event. The assumption that voluntary codes will make vendors ship secure software. The assumption that 2035 is far away. Every one of those assumptions got challenged today.

Jordan: And the through-line for CISOs is that the tools and models you built your program on three years ago may not be adequate for the threat landscape you're operating in today. That's not a criticism. That's the reality of a field that moves this fast. The question is whether you're adapting at the same pace as the threat.

Alex: Well said. That's our show for today. Show notes and links to every story we covered are at cleartext.fm. We'll be back tomorrow.

Jordan: Stay sharp.