Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
July 15, 2026
Soru: As the vulnerability analyst, decide whether to emergency-patch our two internet-facing NetScaler Gateway instances against CVE-2026-8451 — the new "CitrixBleed
Emergency-patch our internet-facing NetScaler Gateways against CVE-2026-8451?
Patch prioritization note: emergency-patch the two internet-facing NetScaler Gateway instances tonight, ahead of the Patch Tuesday backlog, unless each instance is verified as already fixed or not exposed in the affected SAML IdP condition....
- 4
- Findings
- 7
- Experts
- 17
- Messages
Soru: As the SOC shift lead, decide whether three staff reports of unsolicited device-code prompts matching the EvilTokens phishing kit justify disabling the OAuth de
Three device-code phishing reports — disable the OAuth device flow now?
SOC decision: do not rely on “device-code flow only from managed/compliant devices” tonight. Marcus anchored the key point to Microsoft Conditional Access grant-control behavior: for OAuth device-code flow, the managed-device/device-state g...
- 4
- Findings
- 7
- Experts
- 19
- Messages
Soru: As the GRC lead, decide whether our connected-product line falls within the EU Cyber Resilience Act's incident and vulnerability reporting obligations taking ef
Do our connected products fall under the EU Cyber Resilience Act's reporting duties?
The panel’s decision-ready position: do not approve a definitive out-of-scope position on the current facts. A “connected-product line” should be provisionally treated as CRA-relevant unless Legal/Product/GRC can document a specific exclusi...
- 4
- Findings
- 6
- Experts
- 22
- Messages
Soru: As CISO, decide whether to accept ServiceNow's assurance that June's unauthenticated-API incident — a REST endpoint shipped with authentication disabled, exploi
Accept ServiceNow's assurance on the unauthenticated-API incident, or push back?
Vendor claim evaluation brief: do not accept ServiceNow’s assurance as decision-grade without tenant-specific evidence. The panel’s position is conditional acceptance only if ServiceNow proves the request path did not reach your tenant data...
- 5
- Findings
- 7
- Experts
- 19
- Messages
Password Resets Lose To OAuth Grants After Cloud Account Abuse
A cleaned account can still be an open door if OAuth grants, refresh tokens and enrolled devices remain trusted. The call was to break that trust before celebrating rotation.
- 4
- Findings
- 12
- Experts
- 18
- Messages
SonicWall SMA 1000 Jumps The Queue; Yesterday's Router Alarm Waits
SonicWall SMA 1000 sits in the path attackers want after login, and AD FS sits behind the logins themselves. That combination beat the louder Russian router campaign into a same-day change window, with SharePoint hardening dragged along.
- 5
- Findings
- 12
- Experts
- 19
- Messages
July 14, 2026
Soru: As the engineering lead deciding for my own team, decide whether to keep AI coding assistants (Claude Code, Cursor, Gemini CLI) enabled for all forty developers
Keep AI coding assistants enabled for all forty developers?
Risk acceptance memo: approve a 30-day conditional hybrid policy, not all-developer normal-workstation enablement. Claude Code, Cursor, and Gemini CLI may be used only where secrets, production paths, and outbound behavior are provably cons...
- 5
- Findings
- 8
- Experts
- 21
- Messages
Grok Build Jumps The Queue After Sending Whole Git Repos To xAI
The loud router and ShareFile alarms had already had their turn; default repo uploads changed the risk math. If Grok Build saw a workspace, the question is which secrets and code went with it.
- 4
- Findings
- 10
- Experts
- 16
- Messages
PAN-OS Captive Portals Jump Ahead Of Yesterday's GlobalProtect Alarm
The firewall is the foothold, not the backlog: CVE-2026-0300 puts exposed PAN-OS Captive/User-ID portals under reported active exploitation, while yesterday’s GlobalProtect work still has to prove no sessions or config changes survived.
- 5
- Findings
- 10
- Experts
- 16
- Messages
July 13, 2026
NetScaler Patch-Only Loses To Session Revocation In DragonForce Reports
A fixed appliance may still leave stolen NetScaler sessions alive. Reported CVE-2025-5777 exploitation with DragonForce follow-on activity pushed the call past patching and into whether access already walked through the front door.
- 5
- Findings
- 10
- Experts
- 18
- Messages
ModHeader’s Spyware SDK Outranks Another Patch Drill In Developer Browsers
A Chrome extension is not just a browser nuisance when it lives beside consoles, repos and SSO. ModHeader’s hidden spyware SDK shifted the call to what that browser session can sign, read or ship.
- 5
- Findings
- 11
- Experts
- 18
- Messages
July 12, 2026
Langflow’s New RCE Jumps The Queue And Goes Straight To Isolation
An exposed AI workflow server is now a containment problem, not a patch chore. CVE-2026-5027 gave Langflow fresh exploitation evidence while the CMS and ColdFusion items stayed where they were.
- 5
- Findings
- 11
- Experts
- 19
- Messages
Reported [email protected] Installs Send CI Runners To Quarantine
If a build pulled [email protected] in the last few days, the problem is on the machine, not in the code. The panel put the reported npm compromise ahead of the CMS-webshell noise because a poisoned install reaches the tokens a CI runner ho...
- 5
- Findings
- 11
- Experts
- 19
- Messages
July 11, 2026
Unmanaged Android VPNs Lose Enterprise Access After 281-App Study
A privacy story became an access-control call: 281 Android VPN apps showed leaks or tracking, enough to make unmanaged VPNs a conditional-access problem rather than a user-choice problem.
- 5
- Findings
- 11
- Experts
- 20
- Messages
Exposed ShareFile Storage Zone Controllers Come Offline Today
File-transfer uptime lost the argument to containment: Progress is reportedly telling customers to power off exposed ShareFile Storage Zone Controllers, forcing reroutes while responders work out whether the box stayed clean.
- 5
- Findings
- 11
- Experts
- 18
- Messages
July 10, 2026
Revoke FortiGate Admin And VPN Sessions Before Counting Patches
A box that is only unpatched is not the model now: access to 74,000 FortiGate devices is reportedly for sale. The gap is whether old admin and VPN sessions still work after the patch dashboard turns green.
- 5
- Findings
- 11
- Experts
- 16
- Messages
July 9, 2026
CISA KEV Puts ColdFusion Isolation Ahead Of Patch Theater Tonight
An internet-facing ColdFusion box is no longer a hygiene ticket once CISA puts it in KEV. The hard call is whether to take it out of service long enough to prove it was not already used.
- 5
- Findings
- 12
- Experts
- 20
- Messages
July 8, 2026
ColdFusion CVE-2026-48282 Beats Langflow When RDS Faces The Internet
The AI-ransomware label had heat, but exposed ColdFusion RDS gives attackers a straighter path to web shells. Langflow still matters where it reaches PostgreSQL or MinIO; it just does not outrank that box.
- 5
- Findings
- 11
- Experts
- 16
- Messages
Cisco Catalyst SD-WAN Beats TeamPCP As Exploitation Signals Outrank CI/CD Allegations
Ransomware-linked CI/CD claims were actionable for secrets, but not enough to outrank Cisco Catalyst SD-WAN with CISA/vendor exploitation signals. ColdFusion RDS stayed in the same urgent class.
- 5
- Findings
- 12
- Experts
- 16
- Messages
July 7, 2026
BeyondTrust Comes Offline: Remote Support Is Too Privileged To Patch Later
A remote-support auth bypass is not another appliance bug; it is the path admins use to touch everything else. BeyondTrust public reachability lost to the risk of handing attackers the help desk.
- 5
- Findings
- 12
- Experts
- 18
- Messages