Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
April 24, 2026
Bitwarden CLI Turns Stolen npm Tokens Into A Package-Republishing Worm
The bad package is only the start: in 93 minutes, stolen npm tokens may have republished malware into 200–500 downstream packages. The work now moves to what each infected developer could publish.
- 5
- Findings
- 10
- Experts
- 11
- Messages
PSAPs Lock Intrado 911 EGW Management To Bastions Before Patching
The npm-and-PyPI worm was the loud story; the panel put the 911 network first. Intrado's Emergency Gateway sits one management-plane mistake away from the calls it routes — so move its admin access behind a bastion before you patch, and lea...
- 5
- Findings
- 10
- Experts
- 12
- Messages
TeamPCP’s ICP Canister C2 Beats The Usual Takedown Playbook
Domain seizures and hosting calls do not reach cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0.io; defenders are left watching behavior instead of waiting for a provider to pull the plug.
- 5
- Findings
- 10
- Experts
- 11
- Messages
Xinference Beats Bitwarden After 680,000 PyPI Downloads Hit Enterprise ML
The quieter PyPI compromise now carries the larger bill: 680,000 Xinference downloads landed in enterprise ML stacks, while Bitwarden’s confirmed blast radius shrank to 334.
- 5
- Findings
- 11
- Experts
- 10
- Messages
Bitwarden Vaults Hold; End-User Password Rotation Loses To Developer Tokens
The vault panic eased, but the build pipeline did not. Bitwarden says no vault data was accessed, moving user password resets back into change windows while GitHub, npm and cloud tokens remain the harder call.
- 5
- Findings
- 10
- Experts
- 7
- Messages
Signal Wasn't Broken; iOS Kept Deleted Messages Across Encrypted Apps
The uncomfortable part is the phone keeping text where apps cannot delete it. Apple patched CVE-2026-28950 after FBI forensics recovered deleted Signal messages, and the same preview path touches WhatsApp and Telegram.
- 5
- Findings
- 10
- Experts
- 6
- Messages