Holding CISO Excom brief: strategic cyber week 9-16 Aug 2026

Alex, rank the candidate lanes from the 9–16 Aug 2026 CyberBrief corpus by compromise depth and cross-company authority—not CVSS. Focus on what changes holding-wide posture versus what remains subsidiary patching. Evidence to test: N-central CVE-2026-18577 active exploitation with Take Control/Cloudflare-tunnel persistence; LoadMaster CVE-2026-8037 in KEV; SonicWall SMA1000 and Gunra/Fortinet activity; NetScaler CVE-2026-8451 session-cookie leakage/probing; Metabase CVE-2026-72898 exploitation and Framework data exposure; vCenter CVE-2026-59310 with reported reverse_ssh; PTC CVE-2026-12569, SAP CVE-2026-58231, SharePoint, unpatched GeoServer, TeamCity; Dream Job CVE-2026-68820. Give a hard keep/drop call for each strategic lane, the trigger for assume-compromise, and what a CISO should not over-claim. Do not repeat prior sessions unless the weekly synthesis changes the decision.

The compromise-depth ranking is N-central, vCenter, Metabase, LoadMaster, PTC, then NetScaler. The first three have evidence beyond vulnerability scoring: persistence or confirmed unauthorized access. That is the line between a holding-wide incident and a patch queue.

The posture change is immediate for N-central, affected holding vCenter, and centrally shared Metabase. LoadMaster, PTC, and qualifying NetScaler deployments require rapid hunting, but exposure alone is not a breach declaration.

Lena, build an evidence-confidence ledger for the seven proposed board lanes covering 9–16 Aug 2026. Separate vendor/government-confirmed exploitation, credible researcher observation, telemetry, victim disclosure, and adversary/media claims. Pay special attention to Cl0p's 43-victim/89 GB PTC claims, vCenter's 361 IPs, LiteLLM's 2,500 organizations/434,000 pipelines, alleged Texas chlorine set-point tampering, Polish CHP disruption, Gunra product attribution, and Lazarus/Operation Dream Job targeting. For each lane say decision-grade, conditional, or accept-and-watch, and identify the exact sentence Excom must not hear because the evidence cannot support it.

The ledger supports urgent action in three lanes, but only vCenter has direct exploitation telemetry. Actor attribution remains weaker than exploitation evidence.

Pierre, translate the seven candidate lanes into holding-level portfolio exposure across industrial/OT, software/SaaS, financial, defense-adjacent, and digital-properties companies. Keep only issues that justify capital, a holding mandate, disclosure readiness, MSP/vendor concentration action, or explicit risk acceptance. Propose exactly three Excom decisions for this week, with a concrete resource or governance ask and a 7-day measurable outcome. Do not use wide ranges or a CVE list; distinguish shared control-plane risk from local remediation.

The portfolio exposure separates cleanly. Shared control-plane risk—MSP/RMM, build systems and virtualization management—cuts across software/SaaS, financial and defense-adjacent holdings and can create simultaneous compromise. Local remediation covers OT engineering systems, Windows estates, commerce integrations and digital edge platforms: industrial holdings face production interruption; digital-properties and SaaS holdings face revenue/SLA loss; financial and defense-adjacent companies add disclosure sensitivity. Third-party concentration deserves holding-level treatment: nearly 700 incidents affected Russell 3000 companies over two years, with one-third involving suppliers. I cannot responsibly price portfolio loss without deployment counts, revenue-at-risk and recovery-time data.

1. Mandate shared-control-plane containment. Assign a holding-level incident commander plus two engineers per company. Within seven days, inventory 100% of MSP/RMM, build and virtualization controllers; remediate or isolate every exposed instance, with CEO-signed exceptions.
2. Fund local, risk-based remediation. Give each industrial, commerce and digital-properties holding one protected maintenance window and an OT/application owner. Within seven days, every critical local asset must be fixed, isolated, or covered by explicit business risk acceptance—without treating routine endpoint work as portfolio capital.
3. Activate disclosure and concentration governance. Create a legal-finance-procurement cell and require each holding to submit a materiality worksheet. Within seven days, identify the top two shared technology providers, validate alternative privileged access, and prepare draft customer, regulator and insurer notifications. SEC-related guidance requires assessing both quantitative losses and qualitative harm, including customer confidence.

Sara, isolate the decision-grade OT/safety signal from the week. Compare the Polish CHP PLC disruption, reporting about internet-facing water controls, and the alleged Texas chlorine set-point incident. What is verified, what is merely alleged, and what holding-wide mandate is warranted for industrial subsidiaries even if attribution and individual incident details remain uncertain? Give an OT-safe 7-day action sequence that avoids unsafe IT-style containment, plus the statement the board must not over-claim.

Halil, the strongest decision-grade signal is the Polish CHP disruption. Multiple reports citing CERT Polska agree that attackers crossed from an exposed Fortinet device through a Teltonika router and private APN, reached WAGO and Siemens controllers, placed Siemens PLCs in STOP mode, and disrupted the steam turbine and water-treatment system. Operators recovered before customers lost heat or electricity. The technical sequence is well corroborated; Russian linkage is less important operationally and should remain qualified. Separately, Forescout’s finding of more than 4,000 internet-visible Rockwell/Allen-Bradley controllers—2,844 in the US—verifies substantial exposure, but visibility does not prove that every controller was compromised. The Texas chlorine-set-point story remains alleged: the available report claims near-zero dosing and operator intervention, but I have no corroborating utility or official government statement confirming the manipulation, victim count, attribution, or water-quality outcome.

Holding-wide mandate: every industrial subsidiary must demonstrate that no Level 2/1 controller or HMI is directly internet-accessible—or implicitly reachable through cellular/private-APN peer connectivity. Remote access should terminate through a managed Level 3.5 OT DMZ using named accounts, MFA where supported, time-limited approval and session logging. Default credentials, undocumented cellular paths and uncontrolled vendor access become reportable safety exceptions. This mandate is justified by the verified access patterns without depending on the Texas allegation or common attribution.

OT-safe seven-day sequence:

1. Day 1: Put site operations and process-safety personnel in command. Independently verify process values, alarms and water chemistry locally; do not trust only the HMI.
2. Day 2: Inventory internet, VPN, cellular, APN, vendor-laptop and historian pathways. Identify Level 2/1 assets reachable from each path.
3. Day 3: Preserve firewall, router, engineering-workstation and controller logs/configurations. Check for STOP events, unexpected logic changes, new passwords and altered network settings. Do not reboot controllers merely to “clean” them.
4. Day 4: Safely close direct exposure, disable unused remote sessions and rotate exposed credentials from a trusted workstation. Maintain local/manual control capability.
5. Day 5: Enforce APN peer isolation and allowlisted OT-DMZ access. Test every firewall or segmentation change before production deployment; breaking a safety communication path may create the larger hazard.
6. Day 6: Secure known-good PLC logic, HMI configurations and network-device backups; validate restoration procedures without writing to live controllers.
7. Day 7: Conduct a site exercise for unauthorized set-point change, controller STOP and remote-access compromise. Schedule firmware changes through engineering review and maintenance windows rather than an IT-style emergency patch cycle.

The board must not say: “Iranian or Russian actors compromised multiple water utilities and altered chlorine dosing without affecting consumers.” The defensible statement is: “Verified OT intrusions and widespread external exposure demonstrate a credible ability to disrupt industrial processes; individual US water incidents, victim scope, physical effects and attribution remain under investigation.”

Claim: You assessed the Polish CHP disruption as accept-and-watch because no substantiated operator disclosure, forensic chronology, or government attribution was present. Counter-evidence: Sara reports that multiple accounts citing CERT Polska provide a consistent technical sequence: exposed Fortinet device to Teltonika router/private APN, then WAGO and Siemens controllers, Siemens PLCs placed in STOP mode, disrupting the steam turbine and water-treatment system before operator recovery. Reconcile the evidence threshold. Is the incident decision-grade for an OT remote-access mandate even if victim identity and Russian attribution remain qualified?

You’re right—the earlier accept-and-watch threshold was too conservative. Multiple reports citing CERT Polska consistently reconstruct the chain: FortiGate foothold, Teltonika/private-APN pivot, default WAGO credentials, Siemens PLCs placed in STOP mode, then turbine and water-treatment disruption. Operational confidence: high; decision-grade for an OT remote-access mandate. ATT&CK ICS: T0822, T0859 and T0813.

As Sara noted publicly: treat private APNs as untrusted, isolate clients, prohibit direct Level 2/1 access, broker sessions through Level 3.5 with named accounts, MFA and logging, and alert on PLC mode changes. Victim identity remains undisclosed; Russian linkage is moderate confidence at most, and no Fortinet CVE is established. Excom must not hear: “CERT Polska proved Russian state hackers exploited a Fortinet vulnerability to sabotage a named Polish plant.”

Tomas, decide whether the week’s supply-chain stories belong in one holding-level lane or should be split. Evidence: SANDCLOCK propagated from compromised Trivy v0.69.4/mutable action tags into LiteLLM CI, exposing a publishing token and malicious PyPI 1.82.7/1.82.8 for about 40 minutes; 2,488 domains/434,000 pipelines are potential exposure, not execution. BdThemes' poisoned remote JSON feed created rogue WordPress admin... [arg clipped]

Halil, use one holding-level umbrella but split it into two operational lanes. SANDCLOCK is a CI/package-publication trust failure: mutable Trivy action tags reached LiteLLM CI, exposed a publishing credential, and enabled malicious PyPI releases 1.82.7/1.82.8. Reported organization and pipeline figures represent potential exposure—not confirmed installation, execution, or compromise.

BdThemes is a runtime content-distribution failure. Plugin repository code remained unchanged; a poisoned remote JSON feed reached a vulnerable admin-banner component, executing in authenticated WordPress administrator sessions and enabling rogue admins or webshell persistence. Its blast radius depends on affected plugins, receipt of the malicious response, and an administrator loading wp-admin—not Python package execution.

Keep separate incident metrics, owners, and playbooks. For SANDCLOCK: identify execution of the poisoned versions, rebuild runners, rotate accessible secrets, invalidate downstream artifacts, pin actions by commit hash, and adopt trusted publishing. For BdThemes: disable affected plugins or remote-feed access and hunt for unknown administrators, fake plugins, MU-plugin implants, and webshells. A conventional SBOM may find the plugins but miss the remotely loaded JSON trust edge.

Sofia, build a disclosure-readiness trigger matrix—not legal boilerplate—for the board-relevant lanes: Metabase customer-data access; privileged MSP/RMM or vCenter compromise; PTC/Windchill engineering-data exposure; CI secret theft; OT process disruption; and targeted defense-adjacent recruiting compromise. Distinguish exposure from a notifiable incident across GDPR, NIS2/DORA where relevant, securities materiality, contract, customer, insur... [arg clipped]

Halil, the verified baseline is narrow: GDPR Article 33 applies when unauthorized personal-data access creates a risk that is not unlikely, with supervisory-authority notification within 72 hours of awareness; Article 34 adds individual notification without undue delay where high risk is likely. All personal-data breaches must be documented. NIS2 Article 23 applies only to an in-scope essential or important entity’s significant incident: early warning within 24 hours, incident notification within 72 hours, and generally a final report within one month.

For DORA and securities disclosure, I could not verify the current official classification criteria or filing deadlines from the available evidence, so those cells must remain open rather than using an unverified clock. The board packet should show, for every lane: awareness time, affected legal entity, role and jurisdiction, confirmed versus possible access, GDPR/NIS2 decision owner, contractual/customer deadlines, insurer notice wording, and a documented securities-materiality assessment. Do not wait for patching or attribution before starting clocks tied to awareness.

Elena, test whether either the OT incidents or Operation Dream Job/CVE-2026-68820 changes holding-level posture beyond ordinary exposure management. Keep attribution disciplined: Polish CHP mechanics are now high-confidence but Russian linkage may be qualified; Texas chlorine tampering is uncorroborated; public reporting links Dream Job to Lazarus/DPRK and defense/aerospace/aviation recruitment, but current targeting evidence may be thin. Which first-ord... [arg clipped]

Halil, the Polish OT incident is the first-order holding-level risk—but only for portfolios containing energy, water, or shared OT operations. CERT Polska documented destructive malware, default-credential abuse and damaged control equipment at Polish CHP and renewable facilities. Russian linkage remains qualified: reporting divides between FSB-linked Dragonfly/STATIC TUNDRA and GRU-linked Sandworm/ELECTRUM. Assessment: that demonstrated physical-process intent warrants centralized OT asset discovery, remote-access control and safety-response governance beyond routine vulnerability management. The alleged Texas chlorine manipulation remains uncorroborated and should not drive strategic escalation.

Operation Dream Job warrants a narrower counterintelligence posture for defense, aerospace and aviation holdings. Check Point reports Lazarus using recruitment lures and CVE-2026-68820 to deploy FudModule; Microsoft classifies the flaw as local, high-complexity privilege escalation, meaning attackers still require an initial foothold. Assessment: patch centrally and hunt across recruitment-facing staff, but do not infer portfolio-wide DPRK targeting without victim or telemetry evidence. In short: OT safety risk leads; Dream Job becomes holding-level only where sensitive-sector concentration or shared identity and endpoint infrastructure creates aggregation risk.

Give me a concise keep/merge/relegate decision for every named candidate, explicitly noting stale/no-delta items: Gunra/Fortinet/FortiProxy; SonicWall SMA1000; Check Point VPN; N-central CVE-2026-18577; LoadMaster CVE-2026-8037; NetScaler CVE-2026-8451; OWA CVE-2026-42897; Metabase CVE-2026-72898; vCenter CVE-2026-59310; PTC Windchill CVE-2026-12569; SAP Commerce CVE-2026-58231; SharePoint CVE-2026-55040; unpatched GeoServer; TeamCity CVE-2026-63077; Dream Job CVE-2026-68820. The output must distinguish holding-wide governance from subsidiary remediation and avoid CVE laundry-list logic.

Halil, KEEP means holding-wide governance; MERGE means one shared control-plane lane; RELEGATE means subsidiary remediation. Vulnerabilities do not get board seats merely for having CVE numbers.

The three standalone holding incidents are N-central, vCenter, and shared Metabase. Everything else either joins an existing control-plane programme or stays with the subsidiary until telemetry proves authority crossed.

Stress-test the seven candidate lanes against a board threshold. Produce a compact matrix: lane kept or relegated; first-order sectors among industrial/OT, software/SaaS, financial, defense-adjacent, digital properties; business consequence; Excom ask category (money, mandate, disclosure readiness, MSP concentration, accept-and-watch). Then reduce your proposal to exactly three decisions this week, each with a measurable seven-day deliverable.

The board threshold is simple: keep a lane if one compromised instance can interrupt multiple holdings, corrupt trusted delivery, halt production, or trigger material disclosure. CISA confirms exploitation affecting N-central and TeamCity; N-able reports limited customer impact, while SAP lists serious manufacturing and commerce weaknesses without evidence here of exploitation.

Exactly three decisions this week:

1. Mandate shared-plane containment: Group CISO authority plus one senior engineer per affected holding. Seven-day deliverable: 100% inventory of N-central, TeamCity and vCenter; every exposed instance remediated or isolated, with CEO-signed exceptions.
2. Fund production-critical remediation: One protected maintenance window and up to 40 specialist hours per affected OT, SAP or edge environment. Seven-day deliverable: every matched critical deployment patched, isolated or explicitly accepted by its business owner.
3. Activate concentration and disclosure readiness: CFO, general counsel and procurement cell with one accountable owner per holding. Seven-day deliverable: signed materiality assessment for every kept lane, complete MSP dependency map, and tested alternative privileged access for every MSP-managed holding.

Add the specific NYDFS delta: its 11 Aug N-central alert tells regulated entities to determine direct and third-party N-central use, assess unauthorized/persistent access, verify mitigation, and evaluate affected systems/credentials; boards remain accountable for third-party cyber risk. Does that make MSP/RMM inventory and evidence rights a governance decision even without a confirmed breach? Also state which other lanes require disclosure readiness now versus only documented watch.

Yes, Halil. Fact: the 11 August NYDFS alert requires regulated entities promptly to identify direct and third-party N-central use, investigate unauthorized or persistent access, verify mitigation, and assess affected systems and credentials. Part 500 also requires third-party identification, risk assessment and minimum cybersecurity requirements, while senior governance remains responsible. Assessment: MSP/RMM inventory and contractual evidence rights—log access, forensic cooperation, downstream-provider identification and timely attestations—are therefore governance decisions even without a confirmed breach. The alert triggers investigation and a disclosure-readiness file, not automatic regulator or customer notification.

• Disclosure readiness now: N-central use anywhere in the supply chain; confirmed Metabase customer-data access; confirmed CI-secret theft; actual OT disruption; confirmed Windchill file access/export; or recruiter mailbox/ATS compromise. Open the jurisdiction-and-contract notice map, preserve awareness times, assign decision owners and prepare draft notices.
• Documented watch only: product exposure, unsuccessful attempts, secret presence without evidence of acquisition/use, anomalous OT traffic without process effect, targeting without account access, or Windchill vulnerability without file access.
• Escalation rule: move immediately from watch to readiness when access, persistence, credential effect, data acquisition or operational impact is evidenced—or when the vendor cannot provide evidence sufficient to exclude it. External disclosure still requires the applicable NYDFS, GDPR/NIS2, contractual, insurance or securities trigger to be met.

Claim: Your three proposed decisions prioritize shared-plane inventory, production-critical remediation, and concentration/disclosure readiness, while treating TeamCity as the central build-plane concern. Counter-evidence: Tomas shows that the in-week supply-chain delta is broader: SANDCLOCK poisoned LiteLLM through Trivy/mutable action tags and exposed a publishing token; BdThemes poisoned a runtime JSON feed. Sara shows the Polish CHP intrusion warrants an OT remote-access mandate. Also, your PTC/Kepware wording appears to conflate Windchill/FlexPLM with a different PTC product family. Revise the three decisions so CI trust and OT access are not lost, and correct the PTC scope without turning the memo into a CVE list.

You are right: TeamCity was too narrow a proxy for CI trust, and my PTC scope was wrong. The PTC lane concerns Windchill/FlexPLM, not Kepware, so it belongs under enterprise product-lifecycle remediation—not OT controls. LiteLLM reporting estimates 2,500 organizations and 434,000 pipeline runs were potentially exposed, although exposure does not prove compromise.

1. Fund and mandate end-to-end software-delivery trust. Assign one platform-security lead and two engineers per software holding. Seven-day deliverable: inventory 100% of production pipelines and runtime feeds; pin third-party actions immutably, rotate exposed publishing credentials, adopt OIDC publishing where supported, and block or cryptographically verify remote runtime feeds. This covers TeamCity, Trivy/LiteLLM and the reported BdThemes pattern.

1. Mandate OT remote-access containment. Give each industrial holding one OT network engineer, one responder and a protected maintenance window. Seven-day deliverable: map every VPN, cellular, private-APN and vendor pathway; remove default credentials; block unapproved paths; and test one controller-recovery procedure at every critical site. The Polish CHP incident crossed a supposedly private APN, stopped controllers, and disrupted turbine and water-treatment operations.

1. Retain shared-plane concentration and disclosure governance, with corrected PTC treatment. Establish a group CISO–CFO–general counsel cell. Seven-day deliverable: complete the MSP/RMM, virtualization and CI-provider concentration map; identify every Windchill/FlexPLM deployment; remediate exposed instances or obtain signed risk acceptance; and prepare a materiality memo wherever compromise evidence exists.

James, close the table. The evidence now supports five holding-level lanes: (1) shared privileged trust planes—N-central CVE-2026-18577, vCenter CVE-2026-59310, and only shared/exposed LoadMaster/NetScaler/TeamCity or similar controllers; (2) Metabase CVE-2026-72898 where actual customer-data access makes this an incident, not just patching; (3) software-delivery trust—Trivy/LiteLLM SANDCLOCK and malicious 1.82.7/1.82.8, plus BdThemes as a separate runtime-feed pattern; (4) OT remote access after the decision-grade Polish CHP disruption, while Texas remains alleged; and (5) conditional enterprise/targeted remediation—Windchill CVE-2026-12569, SAP Commerce CVE-2026-58231 attempts, SharePoint, unpatched GeoServer, and Operation Dream Job/CVE-2026-68820 only where exposure or sector targeting exists. Lena cautions that victim counts and actor claims are weaker than exploitation evidence; Sofia says NYDFS makes third-party N-central inventory/evidence rights a governance duty but not automatic notification; Pierre proposes software-delivery trust, OT remote-access containment, and a shared-plane concentration/disclosure cell as the three Excom decisions. Give the final operational sequence for tonight and seven days. Argue against one element if these three decisions are mis-prioritized. Specify what must be isolated before patching, when to rotate sessions/secrets, when rebuild is required, and which named items stay in the subsidiary patch queue.

Fact: Rapid7 reported no known exploitation or public PoC for vCenter CVE-2026-59310. By contrast, malicious LiteLLM 1.82.7/1.82.8 and Trivy 0.69.4–0.69.6 involved credential-stealing code; removing the package alone may leave persistence. If Pierre’s list implies ordering, I disagree: the shared-plane concentration cell goes first tonight because a single privileged controller can extend exposure across subsidiaries.

Tonight — CRITICAL: Isolate N-central and vCenter management paths before patching, plus any shared or exposed LoadMaster, NetScaler, or TeamCity. Also isolate Metabase with confirmed customer-data access, CI runners that executed the malicious Trivy/LiteLLM releases, and OT remote-access gateways or jump hosts associated with the Polish event—without disrupting safety processes. Preserve logs and snapshots, then revoke active sessions and rotate administrator, service-account, API, cloud, repository, signing, and deployment secrets reachable from those systems. Rebuild executed CI environments from clean images; also rebuild any controller, Metabase host, BdThemes runtime, or OT jump host showing unauthorized code, persistence, altered configuration, erased logs, or unverifiable integrity. Exposure alone requires tested remediation and hunting, not automatic rebuild.

Seven days — HIGH/MEDIUM: Complete holding-wide inventory, test vendor fixes in staging, patch isolated systems, rebuild and re-sign affected artifacts from pinned clean dependencies, and validate identity and configuration integrity before reconnecting. Windchill CVE-2026-12569, SAP Commerce CVE-2026-58231, SharePoint, unpatched GeoServer, Operation Dream Job/CVE-2026-68820, non-shared/non-exposed LoadMaster–NetScaler–TeamCity, and Metabase without access evidence remain in the subsidiary patch queue. I found no current advisory or patch data on those named CVEs in the available evidence, so do not deploy an unverified fix.

Claim: You cited an earlier Rapid7 position that vCenter CVE-2026-59310 had no known exploitation or public PoC, and said no current advisory or patch data was available for several named CVEs. Counter-evidence: The in-week corpus contains later reporting dated 13 Aug: attackers exploited CVE-2026-59310, compromised systems called back through reverse_ssh, and Shadowserver reported 361 compromised IPs across 47 countries; Broadcom fixed it in vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k/U2f with no workaround. The corpus also records current fixes/advisories for Windchill CVE-2026-12569, SAP Commerce CVE-2026-58231, SharePoint CVE-2026-55040, and others. Reconcile by evidence date and revise your sequence. Also separate potential exposure from confirmed execution for Trivy/LiteLLM.

You’re right. My earlier Rapid7 citation reflected the July 30 position and was superseded by August 13 reporting: CVE-2026-59310 was actively exploited using reverse_ssh, with Shadowserver identifying 361 compromised IPs across 47 countries. Broadcom provides fixes in vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k/U2f, with no workaround. My blanket statement about unavailable fixes was also wrong: Windchill CVE-2026-12569 is in CISA KEV with fixed builds, while SAP has published Security Note 3771065 for critical CVE-2026-58231.

Tonight: Isolate every exposed or suspicious vCenter before patching; preserve logs, hunt for reverse_ssh and unauthorized execution, then install the appropriate fixed release. Revoke sessions and rotate SSO, administrator, service-account, certificate, backup, and automation credentials after containment but before reconnection. Any appliance showing code execution, callbacks, altered configuration, missing evidence, or uncertain integrity requires clean redeployment—not an in-place patch. Internet-facing Windchill moves from the subsidiary queue into the same critical lane; exposed SAP Commerce and SharePoint require immediate isolation, hunting, and validated vendor updates. Metabase with confirmed data access remains an incident-response lane.

For Trivy/LiteLLM, a lockfile, registry cache, or downloaded package establishes potential exposure, not execution: quarantine it and confirm runtime use before triggering enterprise-wide rotation. Installation followed by Python/runtime execution, outbound traffic, credential access, or malicious-file persistence establishes confirmed execution: isolate, preserve, revoke reachable secrets, and rebuild the runner or workload from a clean image. Over seven days, patch segmented internal Windchill/SAP/SharePoint systems after staging; GeoServer, CVE-2026-68820, and non-shared/non-exposed controllers remain conditional subsidiary work unless exposure, targeting, or compromise evidence promotes them.

Now give me exactly three Excom motions in board language. Each must specify: the decision, funding or authority required, accountable executive, and seven-day evidence of completion. The motions must collectively cover (a) shared privileged/trust-plane containment and MSP concentration, (b) software-delivery and OT cross-company minimum controls, and (c) incident/materiality/disclosure readiness. Do not list CVEs inside the motions unless essential; keep product-level work in the supporting lane analysis.

1. Shared trust-plane containment: Decision: Authorize immediate holding-wide containment and concentration-risk review of shared privileged platforms and MSP access. Authority/funding: Emergency response budget; authority to disconnect access and compel subsidiaries/MSPs to provide inventories, logs, and evidence. Accountable: Group CIO. Seven-day evidence: Complete dependency map, isolation/remediation status, session and secret-rotation records, and signed MSP evidence-access attestations.

1. Software-delivery and OT controls: Decision: Impose mandatory release-integrity gates and safety-approved OT remote-access controls across every company. Authority/funding: Fund engineering and OT response teams; authorize release freezes and suspension of noncompliant vendor access. Accountable: Group COO. Seven-day evidence: Pipeline and dependency inventory, clean-build attestations, OT remote-access register, closed exceptions, and successful recovery tests for one production build and one OT access path.

1. Incident and disclosure readiness: Decision: Establish a group incident-materiality and disclosure cell with one escalation clock and decision record. Authority/funding: Fund external counsel and forensics; compel daily impact reporting and evidence preservation from subsidiaries and providers. Accountable: Group General Counsel. Seven-day evidence: Consolidated incident register, completed materiality assessments, notification decisions with timestamps, regulator/customer draft communications, and one executive tabletop exercise.

Your table was clipped after NetScaler. Give only the remaining decisions and one-line rationale for: OWA CVE-2026-42897, Metabase CVE-2026-72898, vCenter CVE-2026-59310, PTC Windchill CVE-2026-12569, SAP Commerce CVE-2026-58231, SharePoint CVE-2026-55040, unpatched GeoServer, TeamCity CVE-2026-63077, and Operation Dream Job/CVE-2026-68820. Mark KEEP, MERGE, or RELEGATE.

• OWA CVE-2026-42897 — RELEGATE: No corroborated weekly delta for this exact CVE; keep it in subsidiary Exchange remediation.
• Metabase CVE-2026-72898 — KEEP: Active exploitation and reported unauthorized customer-data access justify holding governance where BI data or tenancy is shared.
• vCenter CVE-2026-59310 — KEEP: Confirmed exploitation deploying reverse_ssh closes a persistence chain against central virtualization authority.
• PTC Windchill CVE-2026-12569 — MERGE: Put it in shared engineering/PLM governance; KEV-listed RCE warrants urgency, but not an automatic breach declaration.
• SAP Commerce CVE-2026-58231 — RELEGATE: Urgent subsidiary patching; available reporting does not verify successful exploitation.
• SharePoint CVE-2026-55040 — MERGE: Handle through the Microsoft collaboration lane until telemetry proves host takeover or token abuse.
• Unpatched GeoServer — RELEGATE: Patch locally; “unpatched” establishes susceptibility, not compromise depth.
• TeamCity CVE-2026-63077 — MERGE: Fold into CI/CD trust governance where builds, runners, or signing credentials are shared.
• Operation Dream Job/CVE-2026-68820 — MERGE: Treat the CVE as holding-wide Windows remediation—it is an exploited local privilege escalation to SYSTEM, not the missing initial-access step.