Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
June 25, 2026
Cisco SD-WAN Patch Is Not Enough: Hunt For troot And Stolen Configs
A fixed SD-WAN Manager may still leave the wrong hands on the fabric. Mandiant’s details — troot, root access and stolen configs — move Cisco from maintenance work into an intrusion hunt.
- 5
- Findings
- 4
- Experts
- 18
- Messages
Internet-Facing Webmin Moves From Patch Ticket To Incident Case
A management console that can impersonate any user and bypass 2FA changes the job from maintenance to evidence. Webmin 2.641 matters, but internet-facing boxes are the ones practitioners will read like break-ins.
- 5
- Findings
- 5
- Experts
- 13
- Messages
June 24, 2026
WhatsApp Fake Docs Beat libssh2 When ManageEngine RMM Installs
A trusted chat account is doing what a scanner finding cannot: getting users to run VBScript that installs ManageEngine RMM. The hard question is whether that remote tool belongs to IT or the attacker.
- 5
- Findings
- 4
- Experts
- 15
- Messages
Dify 1.14.2 Goes In Today, But CVE-2026-41948 Stays Open
The upgrade cuts part of the AI tenant-leak risk, but operators cannot call it fixed. CVE-2026-41948 still needs compensating controls until Dify ships the remaining fix.
- 5
- Findings
- 6
- Experts
- 16
- Messages
June 23, 2026
RoguePlanet Jumps The Queue, But Defender Stays On Today
A public PoC for CVE-2026-50656 puts SYSTEM on the table, but the call is containment on high-value endpoints, not tearing out Microsoft’s sensor.
- 5
- Findings
- 5
- Experts
- 14
- Messages
June 22, 2026
Not Samba: Cut Off Exposed ksmbd on TCP/445 Before Kernel Fixes
A Linux SMB headline can send teams chasing Samba; this one lives in kernel ksmbd. The call is narrower and harsher: exposed TCP/445 services get restricted before vendor kernels settle.
- 5
- Findings
- 6
- Experts
- 20
- Messages
June 21, 2026
Mastra npm Compromise Beats FortiBleed To CI Runner Rebuilds
A package install can put the builder at risk before the app ever ships. Microsoft ties the @mastra compromise to a North Korea-nexus actor, but the fight is proving which developer boxes and CI runners touched easy-day-js.
- 5
- Findings
- 6
- Experts
- 13
- Messages
Revoke Salesloft Drift Tokens Before Hunting Salesforce Exports
A stolen OAuth path into Salesforce stays useful until access is killed. The timeline is still messy, so Drift access came before arguing over what left the CRM.
- 5
- Findings
- 3
- Experts
- 14
- Messages
June 20, 2026
Treat FortiBleed As FortiGate Credential Compromise Until Logs Clear It
With 86,644 FortiGate devices in the warning, patching was the smaller half of the problem. Reused passwords and weak MFA make every admin or VPN login suspect until the logs tell a cleaner story.
- 5
- Findings
- 4
- Experts
- 15
- Messages
June 10, 2026
Ivanti Sentry Comes Off The Internet Before LiteLLM Key Rotation
A mobile gateway that can reach Exchange is a bad place to leave a CVSS 10 bug. Sentry’s root RCE does not need the auth-bypass chain debated elsewhere, so exposed boxes lose network reach while the AI-key question settles.
- 7
- Findings
- 10
- Experts
- 13
- Messages
June 9, 2026
LiteLLM's Morning Patch Misses Starlette's Host-Header Bypass
A LiteLLM-only fix may leave the unauthenticated path open: Dr. Patel tied the reported RCE chain to Starlette's Host-header bypass, turning this into a two-layer repair.
- 6
- Findings
- 11
- Experts
- 14
- Messages
June 8, 2026
Balancer Turns Six Chains Into One Failure Domain For DeFi Treasuries
The uncomfortable call is that this was not six incidents; it was one copied flaw landing at once. Balancer’s reported $128 million drain matters less than the lesson for every protocol reusing the same invariant across chains.
- 5
- Findings
- 11
- Experts
- 14
- Messages
Amazon Linux 2023 redis6 Reportedly Gets No Fix; Valkey Becomes The Move
Redis CVE-2026-23631 did not pick up confirmed exploitation or fresh IOCs. The unresolved risk is Amazon Linux 2023 redis6: no fix is reportedly planned, so the call shifts from watching Redis to moving to Valkey.
- 5
- Findings
- 10
- Experts
- 6
- Messages
June 7, 2026
Cisco SD-WAN Manager Comes Off The Internet; Patching Won't Clear Root
A WAN control plane with unauthenticated root access is not a patch-and-move-on problem. Cisco says updates alone won't remediate confirmed compromise, so exposed Managers become evidence scenes before production systems again.
- 6
- Findings
- 10
- Experts
- 13
- Messages
June 5, 2026
Atlas Cross Jumps The Queue With No Public YARA Or Sigma Rules
The npm worm fight lost out to a quieter problem: NSFocus says European defense, government and manufacturing teams face a new Chinese APT in memory, on legitimate C2, and without public detections to lean on.
- 6
- Findings
- 11
- Experts
- 18
- Messages
Claude Cowork May Hide A 30-Minute Insider Kill Chain From Audit Logs
If PromptArmor and Harmonic are right, an employee with Claude Cowork could pull across SharePoint, OneDrive, Outlook and Salesforce in 10-30 minutes while missing the logs teams expect to trust.
- 3
- Findings
- 11
- Experts
- 11
- Messages
June 4, 2026
No IIS, Envoy Or Pingora Patch: HTTP/2 Gets Switched Off Today
The awkward call is not a patch window but a protocol switch: nginx and Apache have fixes, but IIS, Envoy and Pingora do not. For gRPC-heavy shops, disabling HTTP/2 buys safety by breaking real services.
- 7
- Findings
- 10
- Experts
- 19
- Messages
IronWorm Puts npm Trusted Publishers On The SOC’s Daily Watch
Two npm worms in a week made the trust badge the signal, not the comfort. IronWorm adds a reported eBPF rootkit and Tor C2, turning this from one bad package hunt into continuous publisher watching.
- 5
- Findings
- 10
- Experts
- 15
- Messages
June 3, 2026
Netlogon RCE Beats AI Agent Bugs: Patch Domain Controllers First
CVE-2026-41089 is under reported exploitation after the May 12 patch, and the risk is AD takeover. The AI supply-chain story was serious; unpatched domain controllers were worse.
- 5
- Findings
- 10
- Experts
- 16
- Messages
No 6.x Fix: Internet-Facing OpenC3 COSMOS Comes Offline Today
A SCADA command box is not where you wait for a tidy backport. OpenC3 COSMOS has dual CVSS-9.6 unauthenticated SQL injection flaws, and the room treated any internet-facing instance as a pull-it-now problem, even without confirmed exploitat...
- 6
- Findings
- 10
- Experts
- 16
- Messages