For the first time since launching The Monday Brief, @fulmetalpackets and @aboutsecurity were in the same room, in Dallas, Texas, where we sat down with @GregRich_AI to talk about how AI is changing the fight. 🎥 Special Edition: AI, Cybersecurity & the Small Business Blind Spot open.substack.com/pub/themon…… #ThinkRedActBlue #CyberSecurity #AI #Infosec #ThreatIntel #SecurityLeaders

#PHP2Shell now has a working public exploit. But there's an important detail getting lost in the headlines. The published PoC is tailored to a specific PHP version, Linux distribution, and server configuration. Demonstrating RCE against a known target is not the same as reliably exploiting arbitrary servers across the Internet. In this week's @TheMondayBrief, @aboutsecurity and @fulmetalpackets separate the evidence from the hype. Also this week: 🔹 LiteLLM's release pipeline was hijacked to distribute an info-stealer. 🔹 A certificate authority's private key was literally the number 4. 🔹 APT28 spent two months inside a shipbuilder in a NATO member state. Read the latest issue 👇 themondaybrief.substack.com/… #TheMondayBrief #CyberSecurity #ThreatIntelligence #ThinkRedActBlue

Which of your edge appliances would tell you if it had been compromised three weeks ago? @Mandiant traced NetScaler zero-day exploitation to Sept 3, weeks before public confirmation. A patch closes the hole, but it doesn't prove the attacker left. This week's TMB by @aboutsecurity and @fulmetalpackets 👇 themondaybrief.substack.com/… #CyberSecurity #ThreatIntelligence #NetScaler #InsiderRisk #ThinkRedActBlue

No, we don’t think AI is going to kill us all. Plugin4Shell and OpenAI’s latest reports give us plenty to talk about: code that doesn’t match the approved commit, unauthorized credential use, and instructions to conceal mistakes. Also in this week’s @TheMondayBrief: Cisco ISE under active exploitation, and why FamousSparrow’s targeting of Latin American governments should have you looking at geopolitics when setting your intelligence priorities. @aboutsecurity and @fulmetalpackets get into all of it below👇 themondaybrief.substack.com/… #Cybersecurity #AgenticAI #ThinkRedActBlue

“Hi, this is IT.” Sometimes that’s all it takes to get handed the keyboard. This week: fake IT support on Teams, a hijacked Terraform registry, PostgreSQL privilege abuse and targeted spyware. What happened, why it matters, and what to do, by @aboutsecurity & @fulmetalpackets themondaybrief.substack.com/… #Cybersecurity #TheMondayBrief #ThreatIntelligence #ThinkRedActBlue

New Monday Brief, by @aboutsecurity and @fulmetalpackets 1⃣@OpenAI postmortem on the @huggingface intrusion. 2⃣The @FBI seizure that left QScan and QTRouter inoperable. 3⃣Two more factory implants in white-label ZBT routers. 4⃣The TeamPCP arrests. Four incidents where the facts were available long before the conclusion was 👇 themondaybrief.substack.com/…

Four attacks this week. Every one got past a control that was doing its job. An npm worm with valid signatures. A hotel portal that borrows your MFA. Malware driving Windows Hello keys. And the Snowflake guilty plea. None of these controls broke. The pattern: each control makes a narrow technical claim, and we hear a broad guarantee. Provenance says where a build ran. Not whether it should have. Auth strength says how a user proved themselves. Not which session they proved it to. The attacker isn't beating your controls. He's moving to where they aren't looking. Which of yours have you promoted from evidence to guarantee? This week's Monday Brief by @aboutsecurity and @fulmetalpackets 👇 themondaybrief.substack.com/…

25+ years in this field and the findings have not changed: weak passwords, no network isolation, exposed services nobody inventoried. What changed this week is who found them. Anthropic's own AI models breached three real companies from a test sandbox. A vishing crew went from a Teams call to ransomware in 17 hours. Someone edited water PLC safety logic in seven states with the vendors' own engineering tools. None of them needed an exploit, because the basics were already broken. Think Red by @fulmetalpackets. Act Blue by @aboutsecurity. themondaybrief.substack.com/… #CyberSecurity #ThreatIntelligence #OTSecurity #BlueTeam #InfoSec #SOC #Ransomware

Everyone covered the #OpenAI sandbox escape last week. Two stories got almost no attention. 1/ Sixteen countries signed a joint advisory on a Russian campaign against Zimbra webmail. Laundry Bear. Targets across NATO states, Ukraine and the US, including nuclear installations. Opening the message is enough. The part nobody covered: the payload issues itself an app-specific password and turns IMAP on. Reset every password in the tenant and the adversary is still reading mail. Patch to 10.1.20. Then go audit those credentials. 2/ An operator already inside Thailand's Ministry of Finance ran an open source agent unattended to handle privilege escalation checks and enumeration. Nothing exotic. The approval prompt meant to prevent it is one toggle. If isolating a host in your environment needs a human signature, their clock is faster than yours. @spovolny of @exabeam joins @fulmetalpackets and @aboutsecurity on all three signals this week 👇 themondaybrief.substack.com/… #ThinkRedActBlue #ThreatIntelligence #ZeroTrust #AgenticAI

An AI agent ran a full ransomware kill chain last week. No human at the keyboard. @sysdig calls it JADEPUFFER. But it rode year-old CVEs and left signals everywhere. The shift isn't smarter attacks, it's cheaper ones. New @TheMondayBrief issue today, with @aboutsecurity & @fulmetalpackets ft. @SecHubb @SANSDefense 👇 themondaybrief.substack.com/… #Cybersecurity #BlueTeam #DetectionEngineering #AI #Ransomware #ThinkRedActBlue #CyberDefense

This week's attacks did not beat a perimeter. They walked through doors already open. OAuth tokens. Localhost services. Security tools treated as safe. The thread: trust that outlived its inspection. By @aboutsecurity and @fulmetalpackets. This week featuring guest @GregoryR. Every Monday in your inbox. Subscribe free open.substack.com/pub/themon… #ThinkRedActBlue #TheMondayBrief

Attackers do not need the vulnerability first. They need the map. This week: Ivanti Sentry, ShinyHunters vs PeopleSoft, Agentjacking, a record Patch Tuesday, plus guest commentary from Thomas Roccia (@fr0gger_) on securing AI agents. 👇Subscribe and never miss a Monday. open.substack.com/pub/themon… By @fulmetalpackets and @aboutsecurity #ThinkRedActBlue #TheMondayBrief

New Monday Brief is live. This week the attacker's R&D budget shrank while your attack surface grew. Tricked AI bots, automated EDR evasion, a Claude Code repo takeover, and fake recruiters. No zero-days needed. Plus a first for us: our debut guest perspective, featuring the great Vicente Diaz @trompi Douglas McKee (@fulmetalpackets) thinks 🔴 Ismael Valenzuela (@aboutsecurity) 🔵 Vicente Diaz (@trompi) adds the threat intel lens 🔍 open.substack.com/pub/themon… #ThinkRedActBlue #TheMondayBrief

Four unrelated campaigns last week. One control they all beat: your approval chain. → ransomware that spreads itself over SMB, WMI, and PsExec, no operator needed → AI-built lures and malware at machine scale → a credential stealer pushed as a trusted update → trojanized Zoom installers aimed at US firms New issue of @TheMondayBrief by @fulmetalpackets and @aboutsecurity is out 👇 open.substack.com/pub/themon… #ThinkRedActBlue #TheMondayBrief

In today's issue of @TheMondayBrief, @aboutsecurity and @fulmetalpackets unpack four signals where adversaries went after the layers defenders use to define trust itself: 1️⃣ A PAN-OS zero-day (CVE-2026-0300) gave suspected state-sponsored actors root on internet-facing firewalls for nearly a month before disclosure. 2⃣MuddyWater dressed an Iranian espionage operation as a Chaos ransomware hit to misdirect IR. 3⃣Russian-linked actors struck Polish water treatment SCADA amid a 144% year-over-year surge in attacks on Poland. 📷 🔗Read the full issue: themondaybrief.substack.com/… #ThinkRedActBlue #ThreatIntelligence #ZeroTrust #DetectionEngineering #CISO

Attackers didn’t break new ground this week. They operated where no one was looking. Four intrusions. Different entry points. Same pattern. - A stolen OAuth token from an AI tool became cross-environment access - A patched firewall stayed compromised for months - Consumer routers became covert relay infrastructure - Teams messages delivered malware outside traditional inspection paths The pattern is clear. The attack surface is not where controls exist. It is where visibility ends. 🔴 Think Red: You don’t need to bypass controls if you can operate outside of them 🔵 Act Blue: Monitor the parts of your environment that fall outside your normal coverage Read the full breakdown by @fulmetalpackets and @aboutsecurity: themondaybrief.substack.com/… The Monday Brief is written to be shared. #Cybersecurity #ThreatIntelligence #CISO #DetectionEngineering #TheMondayBrief

Attackers didn’t bypass defenses this week. They used them. Defender zero-days. MCP flaws. Obsidian plugin abuse. Same pattern: 👉 Weaponizing trusted tools 🔴 Think Red: Inherit trust 🔵 Act Blue: Monitor your controls Read the latest issue by @aboutsecurity and @fulmetalpackets: 🔗open.substack.com/pub/themon… #Cybersecurity #ThreatIntel