The Security Brief: DECODED

Weekly intelligence on cybersecurity, critical infrastructure, defense systems, and tech policy — decoded for the professionals who defend it. Subscribe free.

Featured

Cybersecurity

A Fake Bug Report Hijacked AI Coding Agents. No Malware. No Stolen Password. No Breach Required.

Jun 16, 2026

•

9 min read

A Fake Bug Report Hijacked AI Coding Agents. No Malware. No Stolen Password. No Breach Required.

Issue #006 — Splunk's SIEM gets a no-auth RCE. ServiceNow sat on a zero-auth flaw for 44 days. Iran is disrupting U.S. water utility PLCs. And "Agentjacking" just became the AI threat class that matters.

Dani P

Cybersecurity

Meta's AI chatbot handed attackers the keys to 20,000 Instagram accounts. Here is exactly how.

Jun 9, 2026

•

9 min read

Meta's AI chatbot handed attackers the keys to 20,000 Instagram accounts. Here is exactly how.

Issue #005 — The Gentlemen ransomware spreads itself across entire domains. Silent Ransom Group is walking into law offices. SolarWinds actively exploited. And the OT/ICS Corner is now a standing section.

Dani P

Cybersecurity

Red Hat's official npm packages were poisoned with a self-spreading credential worm. Here is what happened.

Jun 2, 2026

•

7 min read

Red Hat's official npm packages were poisoned with a self-spreading credential worm. Here is what happened.

Issue #004 — Plus: Microsoft Defender has two active zero-days with a CISA deadline tomorrow, Palo Alto firewalls under active exploitation, and GitHub breached through a VS Code extension.

Dani P

North Korea did it again. $292 million. Three weeks after Drift. And the damage did not stop there.

Apr 21, 2026

•

15 min read

North Korea did it again. $292 million. Three weeks after Drift. And the damage did not stop there.

Issue #003 — $869M stolen in 2026. CISA faces a $707M budget cut. ShinyHunters hit McGraw-Hill. 5 million hotel guests streamed live to Telegram. Operation Atlantic recovered $12M. Let's get into it.

Dani P

Rockstar refused to pay. The data leaked. Here is what was actually in it.

Apr 15, 2026

•

17 min read

Rockstar refused to pay. The data leaked. Here is what was actually in it.

Issue #002 —The ending nobody expected. Plus: North Korea poisoned Axios, Iran is inside U.S. infrastructure, and your employees' paychecks are being redirected.

Dani P

The White House dropped a new cyber strategy. Here is what it actually means.

Apr 14, 2026

•

1 min read

The White House dropped a new cyber strategy. Here is what it actually means.

Issue #001 — APT28 upgraded. Trizetto breached 3.4M records. North Korea stole $285M in 12 minutes. Real threats. Real analysis. No hype.

Dani P