Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
May 21, 2026
ValleyRAT’s Reportedly Public Rootkit Builder Jumps The Tomcat Patch Race
The loud patch queue lost to a quieter problem: Check Point says a ValleyRAT builder has been public since early 2025, putting kernel persistence and EDR evasion beyond the original operators.
- 7
- Findings
- 11
- Experts
- 16
- Messages
Fox Tempest’s 1,000 Revoked Certs Still Send Teams Hunting Today
Microsoft says Fox Tempest’s signing service is down; the room did not treat that as closure. Early certificates may not be fully caught in revocation lists, which makes signed ransomware payloads the live problem.
- 5
- Findings
- 10
- Experts
- 17
- Messages