Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
October 22, 2026
Installed LiteLLM 1.107.0 Comes Offline; a Patch Is Not Enough
StepSecurity reports malicious payloads across LiteLLM 1.107.0 wheels and official container images, putting installed systems and reachable credentials at risk. Practitioners treated installation as an incident requiring isolation and a tr...
- 5
- Findings
- 10
- Experts
- 13
- Messages
October 21, 2026
CVE-2026-0257 Jumps the Queue for Exposed GlobalProtect Systems
CVE-2026-0257 may allow authentication-override cookies to bypass credentials and MFA on exposed GlobalProtect systems, putting VPN access and downstream credentials at risk. Practitioners put the flaw first, calling for patching, evidence...
- 7
- Findings
- 12
- Experts
- 18
- Messages
eMudhra Distrust Beats Waiting for Confirmed Certificate Abuse
Mozilla and Cloudflare report that eight exposed eMudhra intermediate certificate-authority keys warrant emergency distrust; systems accepting them could validate certificates or software they should reject. Practitioners chose removal now...
- 5
- Findings
- 12
- Experts
- 16
- Messages
October 20, 2026
Potentially Compromised Fortinet Systems Come Offline; AOMEI Waits
According to reporting in the handoff, UNC5820 stole FortiGate and FortiManager configurations, gained root access and left the memory-resident PeerStitch implant, exposing credentials, keys and certificates. Practitioners put those applian...
- 5
- Findings
- 12
- Experts
- 18
- Messages
Rank Math 3.0.123 Sites Need Clean Restores, Not a 3.0.124 Update
SecurityWeek and The Hacker News report that Rank Math PRO 3.0.123 contained a self-restoring backdoor, putting WordPress accounts and hosting credentials at risk on sites that installed it October 15–16. Practitioners rejected an update-on...
- 8
- Findings
- 12
- Experts
- 16
- Messages
October 19, 2026
Unauthorized Entra Access or Role Changes Push ConnectWise Past BeyondTrust
ConnectWise-integrated Microsoft Entra tenants may retain attacker-created secrets, certificates, consent grants or privileged roles after the original app identities are disabled. BeyondTrust CVE-2026-102764 remains the default first job,...
- 7
- Findings
- 11
- Experts
- 18
- Messages
October 18, 2026
Cause Unproven, French Supermarket Refrigeration Stays Local
Multiple reports describe manipulated refrigeration controls at French supermarkets, putting food safety and store operations at risk; the access path and actor remain unknown. Practitioners held the morning’s safety-first line: move affect...
- 5
- Findings
- 13
- Experts
- 17
- Messages
For ConnectWise, Disabling One Microsoft 365 App Identity May Not Be Enough
Reporting on the ConnectWise incident indicates that a compromised Cloud Backup secret reached 173 Microsoft 365 tenants, putting app-only access and tenant data at risk. Practitioners rejected a disable-and-move-on response because app-onl...
- 5
- Findings
- 12
- Experts
- 15
- Messages
October 16, 2026
Safety and Facilities Take Charge of Affected Danfoss, Copeland and Dixell Controllers
French authorities and industry reporting associate refrigeration disruption affecting about 700 supermarkets with exposed controllers; food safety, electrical systems and fire safety may be at risk, while the intrusion path remains unresol...
- 5
- Findings
- 13
- Experts
- 18
- Messages
Potential AdFection Targets Stay Powered On but Off the Network
Citizen Lab says AdFection used targeted ads to deliver Candiru spyware without a click to selected targets, making advertising infrastructure part of the attack path. Practitioners chose to keep potentially targeted devices powered but net...
- 5
- Findings
- 11
- Experts
- 18
- Messages
October 15, 2026
Cisco Secure Email Gateway Exposure Alone Doesn't Trigger a Rebuild
Cisco says attackers are actively exploiting CVE-2026-76519 to gain unauthenticated root access on Secure Email Gateways using a vulnerable content-scanning configuration; CISA has added the flaw to KEV. Practitioners rejected treating ever...
- 6
- Findings
- 10
- Experts
- 19
- Messages
PAN-OS Still Doesn't Jump the Queue Despite Palo Alto's Exploitation Alert
Palo Alto Networks lists PAN-OS CVE-2026-0322 as actively exploited, making exposed firewalls an immediate hunting and mitigation problem. Practitioners called for same-day action but rejected putting every deployment ahead of Cisco or Ivan...
- 5
- Findings
- 12
- Experts
- 18
- Messages
October 14, 2026
A Clean Ivanti Check Won't Put the Appliance Back in Service
Exploitation of Ivanti Connect Secure CVE-2026-104935 can deliver root access and expose identity material, according to the panel's review; a clean Integrity Checker result still cannot rule out compromise. The room trusted logs and eviden...
- 6
- Findings
- 11
- Experts
- 18
- Messages
Ivanti Connect Secure Gets Incident Response, Not a Patch-Only Fix
Ivanti and Volexity report attackers are chaining CVE-2026-104935 for root access on Ivanti Connect Secure, targeting Windows local-admin passwords and BitLocker recovery keys while deleting logs and trying to evade integrity checks. Practi...
- 8
- Findings
- 13
- Experts
- 18
- Messages
October 13, 2026
Google Session Revocation Outranks Completed MFA for UAT-11985
Reporting reviewed by the room says UAT-11985 uses WebSocket phishing to steal authenticated Google sessions despite completed MFA; no victim-side takeover has been reported. Practitioners put session revocation ahead of treating MFA as pro...
- 5
- Findings
- 13
- Experts
- 18
- Messages
Danfoss Controls Come Off the Internet Before Stock Goes Back on Sale
Danfoss refrigeration systems were reportedly manipulated at hundreds of French supermarkets, putting food temperatures and store operations at risk, though the access path and exact store count remain unclear. Practitioners put temperature...
- 8
- Findings
- 11
- Experts
- 17
- Messages
October 12, 2026
Colorado Water Controls Jump the Queue Without a Proven Safety Effect
Source-pack reporting says attackers changed alarms, remote access and pump cycles at two Colorado water providers, putting operations at risk, although no repeatable path to an unsafe process has been established. The room put that potenti...
- 5
- Findings
- 12
- Experts
- 18
- Messages
October 11, 2026
Cisco SD-WAN Jumps the Queue; the Patch Does Not Clear the Manager
Cisco’s advisory confirms active exploitation of CVE-2026-76504 in Catalyst SD-WAN Manager, where administrator access can expose API sessions, credentials and trust relationships with managed devices. The room moved it ahead of SonicWall a...
- 5
- Findings
- 12
- Experts
- 18
- Messages
October 10, 2026
AhsayCBS Beats PaperCut When It Is the Only Trusted Way Back Online
Source-pack reporting describes attacks on internet-exposed AhsayCBS servers through version 10.3.4, putting backup data and the systems trusted to restore operations at risk. PaperCut remains the default first priority, but practitioners m...
- 5
- Findings
- 10
- Experts
- 18
- Messages
Previously Patched PaperCut Servers Need a Fresh Compromise Hunt
PaperCut disclosed exploitation of three flaws in its print-management servers, and watchTowr reported attacks bypassing earlier fixes to run code without authentication. Practitioners sent even previously patched servers back into compromi...
- 8
- Findings
- 11
- Experts
- 16
- Messages