# The Monday Brief The Monday Brief helps leaders navigate real-world cyber threats, AI, technology change, human and geopolitical risk. Each week, we curate the signals that matter most and turn them into clear, strategic insight for decision-makers. Page: Feed: --- ## [Attackers Reached a Polish Power Plant's Controls Through a Private Cellular Network Nobody Was Watching](https://themondaybrief.substack.com/p/attackers-reached-a-polish-power) _2026-08-17 · The Monday Brief_ A Polish power plant breach exposed the danger of treating operator-manage networks as segmentation. Elsewhere, offensive cyber policy, Safe Mode EDR evasion, and AI-assisted intrusions create three v ## [A Self-Propagating npm Worm That Rotates C2 Through Ethereum, and a Hotel Portal That Borrows Your MFA](https://themondaybrief.substack.com/p/a-self-propagating-npm-worm-that) _2026-08-10 · The Monday Brief_ Four attacks that got past controls doing exactly what they were designed to do: valid signatures, real MFA, stolen sessions, and the Snowflake plea. ## [Attackers Are Reaching Water PLCs, Endpoints, and Camera Feeds Without Exploits, and Detection Built for Malware Is Missing Most of It](https://themondaybrief.substack.com/p/attackers-are-reaching-water-plcs) _2026-08-03 · The Monday Brief_ Water PLCs hit in seven states, Lazarus-linked tooling in a ransomware campaign, Claude models breaching real companies from test sandboxes, and a Teams call reaching encryption in under 17 hours. ## [A Zero-Day Gets You Code Execution. Your Architecture Decides What That Gets You (ft. Steve Povolny)](https://themondaybrief.substack.com/p/a-zero-day-gets-you-code-execution) _2026-07-27 · The Monday Brief_ OpenAI's models escaped containment. Laundry Bear turned viewing an email into mailbox theft. Hermes automated post-exploitation after the operator was already inside. ## [Prompt Injection Is an Architectural Property, Not a Bug You Patch](https://themondaybrief.substack.com/p/prompt-injection-is-an-architectural) _2026-07-20 · The Monday Brief_ Prompt injection as design flaw, a Claude for Chrome bypass, Siemens OT zero-days, weaponized coding interviews, and sub-24-hour ransomware. ## [The Ransomware Negotiator Was Working for the Ransomware Gang](https://themondaybrief.substack.com/p/the-ransomware-negotiator-was-working) _2026-07-13 · The Monday Brief_ The negotiator wasn't the only trusted thing that failed this week. An official software package, AI approval workflows, and strategic partnerships deserve a second look. ## [An LLM Agent Just Ran a Complete Ransomware Kill Chain Without a Human Operator. Your Defense Cannot Wait for One Either. (ft. John Hubbard)](https://themondaybrief.substack.com/p/an-llm-agent-just-ran-a-complete) _2026-07-06 · The Monday Brief_ ClickFix delivery, a ToddyCat OAuth backdoor, and same-day NetScaler exploitation round out a week defined by broken assumptions about who, or what, is on the other end. ## [Attackers Exploited the Cisco SD-WAN Zero-Day Two Months Before Disclosure, and Why That Matters to Your Board (ft. Lynda Grindstaff)](https://themondaybrief.substack.com/p/attackers-exploited-the-cisco-sd) _2026-06-29 · The Monday Brief_ A communications provider breached through rogue SD-WAN peering, an infostealer assembly line taken down by court order, and Turla's newest backdoor in Ukraine. ## [Third-Party OAuth Tokens Have Become a Preferred Entry Point for Enterprise Data Theft (ft. Gregory Richardson)](https://themondaybrief.substack.com/p/third-party-oauth-tokens-have-become) _2026-06-22 · The Monday Brief_ A SaaS integration breach hit cybersecurity vendors themselves. A single malicious webpage gave an AI agent full host control. And the security tools defenders depend on became the week's most exploit ## [Fast, secure international transfers (Sponsored)](https://crawlproof.com/a/qyX3VSpOrotN) _2026-06-22 · **Sponsored**_ Bank transfer, cash pickup, mobile wallet — low fees and real-time tracking ## [Attackers Are Building the Target List Before the Vulnerability Drops (ft. Thomas Roccia)](https://themondaybrief.substack.com/p/attackers-are-building-the-target) _2026-06-15 · The Monday Brief_ Attackers map first and exploit later. Ivanti, PeopleSoft, Agentjacking, patch overload, and credential dumps all show how often the operation starts before defenders have a CVE to prioritize.