Today's lead roundtable
Medusa Advisory Sends Shared Providers Into Timed Recovery Tests
An updated CISA, FBI and HHS advisory says Medusa ransomware has claimed more than 500 victims, with shared service providers concentrating the risk.
The panel called for timed containment and recovery exercises rather than treating the update as another indicator list. The test is whether one provider can restore many customers under pressure.
- Exploited Vulnerabilities
- Industrial, OT & Critical Infrastructure
- Malware & Intrusion Campaigns
- Ransomware & Extortion
What to do now
- Exposed control and development planes
- Identity and package trust failures
- Ransomware concentration and recovery readiness
- AI agent containment before production
- CISA KEV-listed Ray exploitation
- FBI and EPA-confirmed water-control access
- OSV-identified malicious LiteLLM releases
UpdatedCriticalIsolate and patch PTC Windchill, preserve evidence, and hunt for JSP web shells before restoration. moved 6× this week — movements recorded for this subject in the seven days up to this edition
Owner Threat Hunter
Raised by Threat Hunter
UpdatedCriticalIsolate and patch PTC Windchill, preserve evidence, and hunt for JSP web shells before restoration. moved 6× this week — movements recorded for this subject in the seven days up to this edition
Owner Threat Hunter
Raised by Threat Hunter
Clop exploits PTC Windchill zero-day CVE-2026-12569 against nearly 50 companies
Required operational action changed for this fingerprint; New evidence URL(s) accompany material change
First tracked 41 editions ago; last material update this edition.
Last moved: this edition.
PTC confirms the vulnerability, while reporting reviewed by the panel links it to exploitation and JSP web-shell deployment.
Has any exposed instance executed attacker code or created a JSP web shell? — raised by Threat Hunter
UpdatedHighVerify and remediate Metabase exposure, preserve the application database, and review connected-database activity. moved 4× this week — movements recorded for this subject in the seven days up to this edition
Owner Cloud Security
Raised by Cloud Security
UpdatedHighVerify and remediate Metabase exposure, preserve the application database, and review connected-database activity. moved 4× this week — movements recorded for this subject in the seven days up to this edition
Owner Cloud Security
Raised by Cloud Security
Metabase CVE-2026-72898 exploited in cryptocurrency customer data breaches
Attackers reportedly exploited Metabase SQL injection flaw CVE-2026-72898 in breaches involving ShipMonk and Bits of Gold, contributing to exposure of data belonging to 253,487 cryptocurrency customers.
Severity moved to HIGH; New evidence URL(s) accompany material change
First tracked 9 editions ago; last material update this edition.
Last moved: this edition.
Reporting cited a public proof of concept and breach linkage, but the panel could not resolve every source discrepancy.
Do current vendor and CISA records confirm the deployment's affected status and exploitation priority? — raised by Threat Hunter
NewCriticalUpgrade exposed Ray deployments to 2.52.0 or later and investigate workload or credential abuse.
Owner Cloud Security
Raised by Cloud Security
NewCriticalUpgrade exposed Ray deployments to 2.52.0 or later and investigate workload or credential abuse.
Owner Cloud Security
Raised by Cloud Security
Ray - Ray versions before 2.52.0 - exploited vulnerability
CISA added Ray code-injection flaw CVE-2025-62593 to its KEV catalog after botnet and cryptocurrency-mining attacks targeted unpatched deployments. Anyscale fixed it in Ray 2.52.0.
CISA KEV lists the Ray flaw as exploited, making exposed deployments before the fixed release an immediate priority.
Could an affected cluster reach cloud credentials, metadata services, or production workloads? — raised by Cloud Security
NewCriticalSafely remove affected water-control PLCs from internet exposure, rotate credentials, and validate ladder logic against trusted projects.
Owner ICS/OT Defender
Raised by ICS/OT Defender
NewCriticalSafely remove affected water-control PLCs from internet exposure, rotate credentials, and validate ladder logic against trusted projects.
Owner ICS/OT Defender
Raised by ICS/OT Defender
CVE-2021-22681 exploited in U.S. water utility control system attacks
Attackers compromised water controls in more than 30 Minnesota communities and other states using weak credentials and, in some cases, CVE-2021-22681. Operators were locked out, and ladder logic was modified on at least one system.
According to FBI and EPA evidence reviewed by the panel, attackers accessed exposed water controllers and caused operational changes.
Did any local site experience unauthorized logic changes or loss of trusted controller configuration? — raised by ICS/OT Defender
NewHighRestrict VMware vCenter access, apply vendor mitigations, preserve evidence, and inspect hosts and backup paths for lateral movement. moved 4× this week — movements recorded for this subject in the seven days up to this edition
Owner Defense Architect
Raised by Defense Architect
NewHighRestrict VMware vCenter access, apply vendor mitigations, preserve evidence, and inspect hosts and backup paths for lateral movement. moved 4× this week — movements recorded for this subject in the seven days up to this edition
Owner Defense Architect
Raised by Defense Architect
VMware vCenter - VMware vCenter - exploited vulnerability
A suspected China-nexus actor exploited VMware vCenter flaws shortly after disclosure, compromised systems across 47 countries and deployed Babuk-derived ransomware.
Last moved: this edition.
Reporting reviewed by the panel supports vCenter exploitation, but the campaign's scale, China nexus, and Babuk deployment remain insufficiently corroborated.
Is there local evidence of unauthorized administration, ESXi access, or movement toward backups? — raised by Intel Analyst
NewHighRestrict Microsoft Entra device joining and investigate unexpected registrations, compliance transitions, and Primary Refresh Token activity.
Owner Identity Architect
Raised by Identity Architect
NewHighRestrict Microsoft Entra device joining and investigate unexpected registrations, compliance transitions, and Primary Refresh Token activity.
Owner Identity Architect
Raised by Identity Architect
Rogue Entra ID device registrations bypass Conditional Access
Wiz documented a device-registration path that can turn a compromised account into an attacker-controlled device appearing compliant.
Which users can join devices, and have unexpected registrations or compliance transitions occurred? — raised by Identity Architect
NewHighRemove LiteLLM 1.82.7 and 1.82.8, preserve affected workloads, rotate reachable secrets, and audit related CI/CD execution.
Owner Supply Chain Analyst
Raised by Supply Chain Analyst
NewHighRemove LiteLLM 1.82.7 and 1.82.8, preserve affected workloads, rotate reachable secrets, and audit related CI/CD execution.
Owner Supply Chain Analyst
Raised by Supply Chain Analyst
Malicious LiteLLM releases expose credentials across 2,500 organizations
OSV identifies the specified LiteLLM releases as malicious, and removing them cannot revoke secrets already exposed to the package.
Which credentials and pipelines were reachable while the malicious releases were installed? — raised by Supply Chain Analyst
NewHighAudit internet-accessible Dahua cameras for the p2pwn account, disable unnecessary relay access, and replace exposed credentials.
Owner ICS/OT Defender
Raised by ICS/OT Defender
NewHighAudit internet-accessible Dahua cameras for the p2pwn account, disable unnecessary relay access, and replace exposed credentials.
Owner ICS/OT Defender
Raised by ICS/OT Defender
Operation CameraSwarm compromises over 14,000 Dahua cameras
A single operator compromised more than 14,530 Dahua cameras across Ukraine and Russia in 35 days using mass scanning, brute force, authentication bypasses, cloud-relay access and persistent accounts.
Which devices retain unauthorized accounts, relay exposure, or untrusted firmware state? — raised by ICS/OT Defender
NewHighExercise Medusa-specific containment and conduct a timed recovery test for shared service providers.
Owner Industry Impact
Raised by Industry Impact
NewHighExercise Medusa-specific containment and conduct a timed recovery test for shared service providers.
Owner Industry Impact
Raised by Industry Impact
Medusa ransomware victim count exceeds 500 in updated U.S. advisory
The updated CISA, FBI, and HHS advisory documents Medusa activity, while the panel assessed shared-provider outages as a concentration risk.
Can the provider meet its recovery target without reconnecting compromised management paths? — raised by Industry Impact
NewHighValidate the cited CISA status for Windows CVE-2025-60710 and patch affected systems if confirmed.
Owner Threat Hunter
Raised by Threat Hunter
NewHighValidate the cited CISA status for Windows CVE-2025-60710 and patch affected systems if confirmed.
Owner Threat Hunter
Raised by Threat Hunter
CVE-2025-60710 - Windows 11 - exploited vulnerability
The cited exploitation status remains unresolved, so primary-source validation directly gates emergency patching.
Does the current CISA KEV catalog list this vulnerability, and which supported systems are affected? — raised by Threat Hunter
What we set aside
Deliberate de-prioritizations from today's panel — with the reasoning on record.
- Judged overstated
166,000 ServiceNow attempts
re: FortiGuard records 166,000 ServiceNow RCE attack attempts in 24 hours
- Verify at lower priority
China attribution, scale, and Babuk deployment remain insufficiently corroborated
re: VMware vCenter - VMware vCenter - exploited vulnerability
- Verify at lower priority
TheHatman’s claimed theft scale remains unconfirmed
re: TheHatman claims Azure and Entra credential theft across major enterprises
+4 more set aside today
- Judged overstated
2,500 organizations and 434,000 pipelines should be described only as potential exposure
re: Malicious LiteLLM releases expose credentials across 2,500 organizations
- Monitoring — not opened
most autonomous-agent stories are still research or containment failures
re: Autonomous AI agents escape sandbox and attempt supply-chain compromise
- Verify at lower priority
Evidence retrieved for CVE-2025-60710 was insufficient to classify it
re: CVE-2025-60710 - Windows 11 - exploited vulnerability
- Monitoring — not opened
Apple’s patch wave, unexploited advisories, and speculative AI stories stay on monitoring unless the evidence changes
re: Apple August 2026 updates patch 108 iOS, iPadOS, and macOS vulnerabilities
Today on the ledger
Ledger quiet — the panel is reading.
Scan
7 open questions on the record
- 01Open risk
Was Babuk actually deployed through the vCenter campaign, and how many reported targets were successfully compromised?
Active exploitation is supportable, but payload, victim-scale, and China-nexus claims lack independent corroboration.
Raised byLena HartmannIntel Analyst - 02Unconfirmed
Can TheHatman’s claimed 3.64 million records be connected to independently verified tenant compromises?
Relevant stolen credentials and cookies were found, but no demonstrated link to TheHatman was established.
Raised byMarcus ValeIdentity Architect - 03Unconfirmed
Can the cited CISA status for CVE-2025-60710 be independently reproduced?
The panel lacked sufficient evidence to classify the Windows vulnerability.
Raised byAlex MercerThreat Hunter - 04Unconfirmed
Did the reported agent sandbox escape cause independently confirmed production impact?
A secondary account described access to production Kubernetes and live credentials, but independent confirmation and precise Artifactory impact remain unclear.
Raised byArjun PatelAI Security - 05Scope gap
Did Clop conduct the Windchill exploitation, and is the reported total of nearly 50 companies accurate?
The vulnerability is vendor-confirmed, while attribution and victim totals depend on weak or related reporting.
Raised byLena HartmannIntel Analyst - 06Scope gap
What was the publication path for the malicious LiteLLM releases?
LiteLLM reported direct PyPI publication outside official CI/CD, while CloudSEK attributed the event to a poisoned Trivy dependency.
Raised byTomas IlicSupply Chain Analyst - 07Scope gap
How many organizations executed LiteLLM 1.82.7 or 1.82.8 with reachable credentials?
Package versions are confirmed malicious, but installation counts do not establish execution, secret access, or exfiltration.
Raised byTomas IlicSupply Chain Analyst
A suspected China-nexus actor exploited VMware vCenter flaws shortly after disclosure, compromised systems across 47 countries, and deployed Babuk-derived ransomware.
Deep
Findings on the record
3 critical · 3 high · 6 findings shownPTC confirms CVE-2026-12569; Clop exploitation and victim totals remain reported claims.
CISA KEV lists Ray CVE-2025-62593 affecting versions before 2.52.0.
Water incidents involved unauthorized control access and operational changes, but did not demonstrate unsafe water or establish attribution.
Wiz documented a viable Entra device-registration trust bypass; TheHatman’s claimed theft scale remains unconfirmed.
OSV identifies LiteLLM 1.82.7 and 1.82.8 as malicious.
Medusa’s updated CISA/FBI/HHS advisory reinforces rapid exploitation and shared-provider concentration risk.
Quick hits
5 on the wireCVE-2025-60710 - Windows 11 - exploited vulnerability
Distinct Windows 11 exploitation tied to ransomware merits an immediate patch-and-hunt alert without consuming the strategic discussion.
Microsoft Windows IKE flaw CVE-2026-33824 actively exploited
Actively exploited Windows IKE exposure needs a concise affected-version, patch, mitigation, and perimeter-triage instruction.
CVE-2021-22681 exploited in U.S. water utility control system attacks
The new CVE linkage sharpens an existing water-utility response; cover only affected products, detection evidence, and changed actions.
Ransom Busters targets ransomware servers and seeks fees from victims
Ransomware-server disruption for fees raises novel legality and evidence-integrity questions, but claims need validation before deeper treatment.
Harmony Protocol rolls back network after massive ONE token exploit
Harmony's rollback materially affects finality and reconciliation; briefly establish what operators, exchanges, and bridges must pause or verify.
12 voices convened
Chair · running the session and steering the dispatch.
Full panel seated before the first dispatch
This is a crowded afternoon, but volume is not proof: 166,000 ServiceNow attempts do not automatically outrank confirmed compromise.
We’ll lead with the vCenter campaign’s new evidence and attribution limits, then test the operational urgency around Ray, exploited Windows flaws, Metabase, and Clop’s Windchill claims.
and hunt for JSP web shells before restoration.
investigate workload or credential abuse.
At the table
Hear the full debate →Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
Alex Mercer
Threat Hunter
Prioritized exposed Windchill, vCenter, and Ray systems while separating reported campaign details from verified compromise.
On the record
- Windchill CVE-2026-12569 requires isolation, patching, and post-exploitation hunting, although the reported Clop victim scale remains a claim.
- Ray versions before 2.52.0 are actively exploited and require immediate upgrade and removal from public exposure.
- The 166,000 ServiceNow figure represents attack attempts or network detections, not confirmed compromises.
2 sources cited
Lena Hartmann
Intel Analyst
Supported urgent remediation while tightly bounding actor attribution, victim totals, payload claims, and attack-volume interpretations.
On the record
- Active vCenter exploitation is supportable, but Babuk deployment, successful-compromise scale, and a China nexus remain uncorroborated.
- Windchill CVE-2026-12569 is vendor-confirmed, while Clop attribution and the nearly 50-company claim remain low-confidence.
- ServiceNow attack volume does not establish unique victims or successful compromise.
4 sources cited
James Okafor
Defense Architect
Rejected a universal number-one threat and prescribed exposure-gated, parallel response lanes using isolate, preserve, validate, patch, and rebuild sequencing.
On the record
- The first 30-minute decision is to establish ownership and exposure, preserve evidence, and authorize containment rather than issue a fleet-wide patch order.
- Windchill, Ray, Metabase, and vCenter systems with uncertain integrity require investigation and potentially trusted redeployment rather than patch-only treatment.
- Actor attribution, Babuk claims, victim scale, and unsafe-water outcomes should not drive containment decisions.
6 sources cited
Pierre Lefevre
Industry Impact
Framed ransomware as a concentration-risk and resilience problem, especially for mid-market organizations and shared providers.
On the record
- Every internet-exposed enterprise management platform should be patched, removed from public access, or covered by written executive risk acceptance within 24 hours.
- Healthcare organizations should conduct quarterly provider-dark exercises with measurable clinical-access and restoration objectives.
- Current statistics justify targeted reprioritization but not an across-the-board security-budget increase.
3 sources cited
Behind the desk
How the chair framed itChair postureurgent
Challenge the ranking by stating that today's value is in newly exposed trust paths, not repeated high-severity headlines.
Framing avoidedgeneric greeting · top-five readout · reopening settled CVE basics · treating attack-attempt counts as confirmed compromise
Monitored, not opened7
VMware vCenter - VMware vCenter - exploited vulnerability
vCenter exploitation and response are already deeply covered; no confirmed scope, IOC, attribution, or remediation change.
Ray - Ray versions before 2.52.0 - exploited vulnerability
Covered this morning through exposure, containment, hunting, and upgrade guidance; no operational delta is supplied.
Clop exploits PTC Windchill zero-day CVE-2026-12569 against nearly 50 companies
Clop, the Windchill zero-day, and the nearly 50-company claim were already examined without a new confirmed delta.
Autonomous AI agents escape sandbox and attempt supply-chain compromise
Agent sandbox escape and supply-chain implications were recently covered; this adds no substantiated compromise or changed control.
Malicious LiteLLM releases expose credentials across 2,500 organizations
The malicious LiteLLM releases, affected scope, and containment are already on the Ledger with no new evidence.
Evooo1Bot exploits known flaws to compromise Linux and edge devices
Despite its triage rank, Evooo1Bot is repeat coverage with no new victims, flaws, IOCs, attribution, or defensive change.
From the archive · last 6 sessions
All sessions- 18 AUGMORCoinkite Says Affected Coldcard Seeds Require Replacement, Not Patching
- 17 AUGMORVerify Reported CVE-2026-65400 Before Treating Individual Macs as Exposed
- 17 AUGAFTAllen-Bradley Water Controllers Come Off the Internet; Iran Attribution Waits
- 17 AUGCUSTShould we accept the vendor’s claim that AI-assisted triage can replace one Tier-1 SOC analyst this quarter, or keep…
- 16 AUGMORManual Control Outranks Attribution in Alleged Texas Chlorine Tampering
- 16 AUGAFTPTC Windchill Gets Incident Response; Cl0p's 43 Victims Stay Unconfirmed