The Monday Brief

The FBI Says Attackers Can Now Lock Defenders Out of Their Own Firewalls

FortiBleed is still active months later. DOJ and FBI seized Flax Typhoon's tooling, OpenAI exposed Russia- and Iran-origin fake newsrooms, and a botnet…

Oct 12 • The Monday Brief

1

Suspected State Actors Exploited a Citrix NetScaler Zero-Day for Three Weeks Before Anyone Confirmed the Campaign

Weeks of NetScaler exploitation, Star Blizzard’s scaled phishing, paid insiders, and Microsoft’s warning that attackers are winning the early AI race.

Oct 5 • The Monday Brief

September 2026

An OpenAI Research Agent Accessed Files It Was Not Authorized to Reach on an Australian Government Portal

Zenity demonstrated zero-click paths through Salesforce Agentforce. Microsoft followed one ransomware affiliate across four payloads. Bitget reported…

Sep 28 • The Monday Brief

Plugin4Shell Lets Attackers Swap Pinned Code, Cisco ISE Is Under Active Explotation, and Why AI Isn’t Going to Kill Us All

Also this week: FamousSparrow targets Latin American governments with a new backdoor, and OpenAI documents agents hiding mistakes and using exposed API…

Sep 21 • The Monday Brief

AI Agents Ran a Two-Bug PaperCut Chain Against 395 Organizations, and Four Espionage Crews Shared One Browser Exploit Kit

This week showed how quickly attackers can scale a working technique once they find something worth reusing.

Sep 14 • The Monday Brief

2

Fake IT Support on Teams, a Hijacked Terraform Registry, and the Access Attackers Put to Work

Also this week: A long-standing PostgreSQL flaw exposes replication accounts, and spyware targets Serbian activists and opposition figures.

Sep 7 • The Monday Brief

1

August 2026

OpenAI's Postmortem Shows the Hugging Face Failure Built Up Over Two Months, and the FBI Took Two Chinese Hacking Platforms Offline

OpenAI traces it back to May, the FBI takes QScan and QTRouter offline, implants ship in ZBT router firmware, and two alleged TeamPCP members are…

Aug 31 • The Monday Brief

Attackers Poisoned a Rust Crate With 245 Million Downloads to Run Malware at Compile Time, Not Runtime

A poisoned arrayref release on crates.io, a passkey kit that survives password resets, encrypted prompts stealing Grok data and bypassing Gemini…

Aug 24 • The Monday Brief

2

Attackers Reached a Polish Power Plant's Controls Through a Private Cellular Network Nobody Was Watching

A Polish power plant breach exposed the danger of treating operator-manage networks as segmentation. Elsewhere, offensive cyber policy, Safe Mode EDR…

Aug 17 • The Monday Brief

2

A Self-Propagating npm Worm That Rotates C2 Through Ethereum, and a Hotel Portal That Borrows Your MFA

Four attacks that got past controls doing exactly what they were designed to do: valid signatures, real MFA, stolen sessions, and the Snowflake plea.

Aug 10 • The Monday Brief

1

Attackers Are Reaching Water PLCs, Endpoints, and Camera Feeds Without Exploits, and Detection Built for Malware Is Missing Most of It

Water PLCs hit in seven states, Lazarus-linked tooling in a ransomware campaign, Claude models breaching real companies from test sandboxes, and a Teams…

Aug 3 • The Monday Brief

2

July 2026

A Zero-Day Gets You Code Execution. Your Architecture Decides What That Gets You (ft. Steve Povolny)

OpenAI's models escaped containment. Laundry Bear turned viewing an email into mailbox theft. Hermes automated post-exploitation after the operator was…

Jul 27 • The Monday Brief

4

1