Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
October 10, 2026
Previously Patched PaperCut Servers Need a Fresh Compromise Hunt
PaperCut disclosed exploitation of three flaws in its print-management servers, and watchTowr reported attacks bypassing earlier fixes to run code without authentication. Practitioners sent even previously patched servers back into compromi...
- 8
- Findings
- 11
- Experts
- 16
- Messages
October 9, 2026
NetScaler Stays First; Clean Local Checks Cannot Clear the Appliance
According to the CyberBrief source pack, exploitation of Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 included configuration theft, artifact deletion and internal tunneling, putting credentials and downstream systems at risk. The room...
- 5
- Findings
- 12
- Experts
- 18
- Messages
Cisco FMC Jumps the Queue; Preserve Evidence Before the Rebuild
Cisco Secure Firewall Management Center flaws CVE-2026-20131 and CVE-2026-20079 are reportedly being exploited at root level, threatening the system used to administer firewalls. Practitioners put FMC first and said installing Cisco’s fix i...
- 5
- Findings
- 11
- Experts
- 17
- Messages
October 8, 2026
Two More Reported NetScaler Flaws Put Citrix Back At The Front
Reporting indicates that NetScaler CVE-2026-88771 and CVE-2026-88772 may expand risk beyond the earlier CVE-2026-88779 issue, raising the possibility of attacker execution on affected appliances. Practitioners put NetScaler back ahead of fr...
- 5
- Findings
- 12
- Experts
- 18
- Messages
ChainDrop Execution, Not Package Presence, Triggers Secret Rotation
Evidence from Unit 42 and Microsoft cited by the panel links ChainDrop to more than 400 npm packages, putting developer and cloud credentials at risk when malicious install scripts ran. Practitioners rejected package presence alone as proof...
- 7
- Findings
- 11
- Experts
- 18
- Messages
October 7, 2026
Apple Patching Goes Fleet-Wide; Forensics Stays With High-Risk Devices
Apple confirmed targeted exploitation of CVE-2026-86950 against its devices, and CISA added the flaw to its KEV catalog. Practitioners favor immediate fleet-wide updates, but reserve evidence preservation and forensic escalation for targete...
- 5
- Findings
- 11
- Experts
- 18
- Messages
Cut Internet Access to Affected MicroLogix Controllers; Attribution Can Wait
Reporting cited in the briefing says unauthorized changes in Rockwell Automation MicroLogix water-control environments contributed to flooding and reduced pressure, while state attribution remains uncertain. Practitioners put operator-led c...
- 5
- Findings
- 10
- Experts
- 17
- Messages
October 6, 2026
NetScaler Leads on CISA-Confirmed Exploitation; RCE Still Needs Proof
CISA added Citrix NetScaler CVE-2026-88779 to its KEV catalog after confirming exploitation; Citrix describes the bug as a memory-overflow flaw in ADC and Gateway appliances. The room kept NetScaler first but rejected crafted SAML usernames...
- 6
- Findings
- 11
- Experts
- 18
- Messages
NetScaler Rebuilds Jump the Queue as TENEX Says Implants May Survive Patches
Citrix says attackers are exploiting CVE-2026-88779 in NetScaler, while CISA’s KEV catalog lists CVE-2026-88771 and TENEX reports implants that may survive patching. Practitioners favored clean replacement capacity and rebuilds over returni...
- 6
- Findings
- 11
- Experts
- 16
- Messages
October 5, 2026
MacSync Hunts Start With the App, Not With iCloud Calendar Traffic
According to Kaspersky, malicious apps, counterfeit software or ClickFix-style commands first establish MacSync execution on a Mac; public iCloud Calendar descriptions then deliver follow-on instructions. Practitioners rejected the easier r...
- 5
- Findings
- 12
- Experts
- 13
- Messages
October 4, 2026
Manual Water Operations Beat Patching After FBI and EPA Disruption Reports
FBI and EPA reporting describes pressure loss, operator lockouts and temporary shutdowns at water facilities in at least seven states, putting physical service and safe plant control at risk. Practitioners put operator-led isolation and man...
- 5
- Findings
- 10
- Experts
- 17
- Messages
October 3, 2026
CISA’s Zammad KEV Additions Jump the Queue for Incident Response
CISA added Zammad CVE-2026-102489 and CVE-2026-102490 to its Known Exploited Vulnerabilities catalog; separate reporting says the chain enabled rapid root access and data theft at DIVD. That evidence makes exposed Zammad deployments the roo...
- 5
- Findings
- 11
- Experts
- 18
- Messages
Zammad, NetScaler, and Cisco SD-WAN Manager Move to Same-Day Remediation
CISA added Zammad CVE-2026-102489 and CVE-2026-102490 to its Known Exploited Vulnerabilities catalog, while CISA and source-pack reporting identify active exploitation involving Citrix NetScaler and Cisco SD-WAN Manager. The room puts same-...
- 5
- Findings
- 11
- Experts
- 18
- Messages
October 2, 2026
Cisco Confirms Attackers Exploiting Critical Catalyst SD-WAN Manager Authentication Bypass
Cisco confirmed active exploitation of CVE-2026-76504, a critical Catalyst SD-WAN Manager authentication bypass that can give an unauthenticated attacker administrator-level API access. Fortinet also reports active exploitation of FortiMail...
- 5
- Findings
- 11
- Experts
- 19
- Messages
FortiMail Gets an Applicability Check Before a Compromise Hunt
Reports of active exploitation against FortiMail CVE-2026-104286 put affected mail systems at risk, but the room could not verify whether Fortinet advisory FG-IR-26-175 or the reported CISA KEV status applies. Practitioners rejected a blank...
- 5
- Findings
- 11
- Experts
- 18
- Messages
October 1, 2026
Catalyst SD-WAN Manager Comes Off The Internet, Not The Network
Cisco reports exploitation of CVE-2026-76504, which can grant administrator-level API access through an unauthenticated request and affects every Catalyst SD-WAN Manager configuration; no workaround exists. Practitioners put it ahead of the...
- 5
- Findings
- 10
- Experts
- 17
- Messages
NetScaler CVE-2026-88772 Jumps the Queue for Compromise Response
CISA KEV and incident reporting in the handoff describe active exploitation of Citrix NetScaler CVE-2026-88772, placing exposed appliances on affected builds with DTLS enabled at risk. The room put those systems first, saying they should be...
- 5
- Findings
- 11
- Experts
- 18
- Messages
September 30, 2026
Apple Patches Exploited CoreGraphics Zero-Day Under Three-Day Federal Deadline
Apple patched CVE-2026-86950, an actively exploited CoreGraphics zero-day, and CISA gave federal agencies three days to remediate it. Exploitation of exposed Citrix NetScaler appliances has meanwhile widened into opportunistic attacks follo...
- 5
- Findings
- 10
- Experts
- 11
- Messages
Iran Attribution Waits. FBI/CISA-Confirmed Water Compromises Come First
CyberBrief, citing FBI and CISA, reports that compromises disrupted operations at U.S. water facilities, putting service continuity at risk. Practitioners put the incident first but refused to treat Iranian responsibility as established bec...
- 5
- Findings
- 10
- Experts
- 15
- Messages
September 29, 2026
Official-Channel Builds Presumed Tainted: DAEMON Tools Hosts Come Offline
An alleged supply-chain compromise may have turned DAEMON Tools Lite 12.5.0.2421–12.5.0.2434 installers downloaded from the official channel between April 8 and May 5 into a route onto trusted Windows hosts. Practitioners treated every host...
- 4
- Findings
- 11
- Experts
- 17
- Messages