No, we don’t think AI is going to kill us all. Plugin4Shell and OpenAI’s latest reports give us plenty to talk about: code that doesn’t match the approved commit, unauthorized credential use, and instructions to conceal mistakes. Also in this week’s @TheMondayBrief: Cisco ISE under active exploitation, and why FamousSparrow’s targeting of Latin American governments should have you looking at geopolitics when setting your intelligence priorities. @aboutsecurity and @fulmetalpackets get into all of it below👇 themondaybrief.substack.com/… #Cybersecurity #AgenticAI #ThinkRedActBlue

“Hi, this is IT.” Sometimes that’s all it takes to get handed the keyboard. This week: fake IT support on Teams, a hijacked Terraform registry, PostgreSQL privilege abuse and targeted spyware. What happened, why it matters, and what to do, by @aboutsecurity & @fulmetalpackets themondaybrief.substack.com/… #Cybersecurity #TheMondayBrief #ThreatIntelligence #ThinkRedActBlue

New Monday Brief, by @aboutsecurity and @fulmetalpackets 1⃣@OpenAI postmortem on the @huggingface intrusion. 2⃣The @FBI seizure that left QScan and QTRouter inoperable. 3⃣Two more factory implants in white-label ZBT routers. 4⃣The TeamPCP arrests. Four incidents where the facts were available long before the conclusion was 👇 themondaybrief.substack.com/…

25+ years in this field and the findings have not changed: weak passwords, no network isolation, exposed services nobody inventoried. What changed this week is who found them. Anthropic's own AI models breached three real companies from a test sandbox. A vishing crew went from a Teams call to ransomware in 17 hours. Someone edited water PLC safety logic in seven states with the vendors' own engineering tools. None of them needed an exploit, because the basics were already broken. Think Red by @fulmetalpackets. Act Blue by @aboutsecurity. themondaybrief.substack.com/… #CyberSecurity #ThreatIntelligence #OTSecurity #BlueTeam #InfoSec #SOC #Ransomware

Everyone covered the #OpenAI sandbox escape last week. Two stories got almost no attention. 1/ Sixteen countries signed a joint advisory on a Russian campaign against Zimbra webmail. Laundry Bear. Targets across NATO states, Ukraine and the US, including nuclear installations. Opening the message is enough. The part nobody covered: the payload issues itself an app-specific password and turns IMAP on. Reset every password in the tenant and the adversary is still reading mail. Patch to 10.1.20. Then go audit those credentials. 2/ An operator already inside Thailand's Ministry of Finance ran an open source agent unattended to handle privilege escalation checks and enumeration. Nothing exotic. The approval prompt meant to prevent it is one toggle. If isolating a host in your environment needs a human signature, their clock is faster than yours. @spovolny of @exabeam joins @fulmetalpackets and @aboutsecurity on all three signals this week 👇 themondaybrief.substack.com/… #ThinkRedActBlue #ThreatIntelligence #ZeroTrust #AgenticAI