Roundtable Archive

Every public Roundtable, on the record.

The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.

Open the Ledger →How it works →RSS: public Roundtable sessions and Decision Records →Podcast RSS: daily edition audio →
Latest on recordAugust 18, 2026
Scheduled · Afternoon edition
Medusa Advisory Sends Shared Providers Into Timed Recovery Tests
6Findings12Experts16Messages
299
Roundtables convened
3,008
Expert seats taken
Apr–Aug
2026 on record
2
Editions / day
Cadence · Mar → Aug

Last 7 days

What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.

14
Sessions
71
Findings
7
Records published
3
Predictions due

Threat domains covered · click to filter this week

Rising entities

Entities appearing in more public Roundtable sessions than in the prior seven days.

Filter the archive · applies instantlyNo filters active · showing all editions
Edition
Source
Showing 281–299 of 299 Roundtables
Sort

April 12, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Adobe Reader Patch Beats ShinyHunters’ Monday Extortion Clock

A four-month Reader campaign finally has a patch; ShinyHunters’ Snowflake deadline is still April 14. Practitioners put the document bug first because unpatched PDFs still hand over code execution today.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
11
Messages
ScheduledAfternoon

No Patch Exists: Rockwell PLCs Come Off The Internet Today

This is not an Iranian zero-day story. CyberAv3ngers can abuse unauthenticated EtherNet/IP on 3,891 exposed Rockwell PLCs, leaving owners with architecture fixes, not a vendor patch.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
7
Findings
10
Experts
12
Messages

April 11, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

IRGC-Affiliated Crews Hunt Siemens And Modbus, Not Just Rockwell

A Rockwell incident is turning into a broader OT problem: scans on S7comm 102 and Modbus 502 point beyond Allen-Bradley screens. The hard part is securing unmanned sites without blinding operators.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
6
Findings
10
Experts
12
Messages
ScheduledAfternoon

Mythos Makes Quarterly Red-Team Cycles Too Slow For One-Day Exploits

The browser-sandbox chain is still unproved; the FreeBSD NFS result is not. A working root RCE in 4 AI hours shifts the question from whether AI can help attackers to how fast defenders can rehearse the next fix.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
11
Messages

April 10, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Rockwell Screens That Lie Beat Claude Mythos For OT Teams Today

The noisy AI story changes exploit economics later; the live safety problem is Rockwell screens an operator may trust today. Iranian actors can alter HMI/SCADA displays while the process keeps running.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
14
Messages
ScheduledAfternoon

Adobe Reader Has No Patch, So Oil And Gas Turns JavaScript Off

For oil and gas, this is not another PDF nuisance: a Sandworm-linked AcroJS flaw has run since December and still has no fix. The uncomfortable call is to break Reader JavaScript before the next document lands.

  • Malware
  • Policy
  • AI security
  • Breach response
  • +8
5
Findings
12
Experts
14
Messages

April 9, 2026

1 edition · morning
View date →
ScheduledMorning

IRGC Actors Have Rockwell PLC Project Files, Not Just Exposed Controllers

The live issue is no longer whether Rockwell PLCs were reachable; IRGC-affiliated actors pulled .ACD logic and left SSH C2 on water and energy controllers. That changes what operators can still trust on the plant floor.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +6
5
Findings
10
Experts
13
Messages

April 8, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Rockwell PLCs Come Off The Internet Before The Patch Window Opens

Internet-exposed Rockwell controllers are now the physical-risk problem, not a patch-management problem. CVE-2021-22681 is five years old, and water and energy sites still cannot patch on IT time.

  • Policy
  • AI security
  • Breach response
  • Crypto / financial crime
  • +7
5
Findings
10
Experts
13
Messages
ScheduledAfternoon

Iran Turns Internet-Facing Rockwell PLCs Into A Key-Switch Problem

Falsified SCADA screens and weakened safety interlocks moved this out of the patch calendar. For water and energy operators, the live question is whether remote programming stays possible at all.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +7
5
Findings
11
Experts
15
Messages

April 7, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

LiteLLM Turns Package Cleanup Into Cloud Key Rotation Across Clouds

Another poisoned dependency would have been routine; this one sat in AI gateways. LiteLLM 1.82.7/1.82.8 puts AWS, GCP, Azure, SSH and K8s secrets in scope, turning cleanup into a credential problem.

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +8
5
Findings
13
Experts
23
Messages
ScheduledAfternoon

FortiClientEMS Beats LiteLLM: EMS Can Push To Every Endpoint

Even with LiteLLM persistence still ugly, the Fortinet box carries the sharper consequence: EMS can push malicious configuration to every managed endpoint. Public PoCs and a six-day head start make this a control-plane problem.

  • Policy
  • AI security
  • Breach response
  • Crypto / financial crime
  • +7
6
Findings
10
Experts
13
Messages

April 6, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Treat Unpatched FortiClient EMS As Compromised, Not Merely Late

The uncomfortable shift is presumption: with six days of zero-day exploitation and 2,800 exposed EMS servers, the patch is only the start. The fight is whether your endpoint manager has already become the attacker’s console.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +7
5
Findings
11
Experts
22
Messages
ScheduledAfternoon

Kill Internet-Facing Telnetd Now; The PoC Is The Wrong Clock

A single unauthenticated packet to GNU InetUtils telnetd buys root on 50,000+ exposed boxes, and the room treated the missing public PoC as a deadline, not comfort.

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +8
5
Findings
13
Experts
21
Messages

April 5, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Fortinet's EMS Patch Fixes One Live Bug And Opens The Next Emergency

The safe middle is gone: EMS 7.4.4 and earlier face mass SQL injection, while 7.4.5 and 7.4.6 carry the auth bypass introduced by the fix. That makes “patched” a question, not a state.

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +6
5
Findings
11
Experts
13
Messages
ScheduledMorning

Axios Is Confirmed; Lodash, Express And dotenv Are Still In Play

Only Axios is confirmed burned, but UNC1069’s outreach has not stopped there. Maintainers behind Lodash, Fastify, dotenv, Express and StandardJS are now the live target.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +6
5
Findings
10
Experts
15
Messages

April 4, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Trivy Jumps The Queue As The Scanner Becomes The Breach Path

The risk is the tool defenders installed on purpose: TeamPCP force-pushed malicious code to 76 of 77 trivy-action tags, turning CI scans into credential theft and making secret rotation the real fight.

  • Malware
  • Policy
  • AI security
  • Breach response
  • +7
5
Findings
11
Experts
12
Messages
ScheduledAfternoon

FortiClient EMS Patch Trap Knocks Trivy Off The Front Page Today

Patching EMS 7.4.4 did not end the exposure; it moved some shops straight into CVE-2026-35616. With 500-1,000 enterprises estimated compromised, the room treated this as an incident, not a maintenance window.

  • Malware
  • Policy
  • AI security
  • Breach response
  • +8
7
Findings
12
Experts
12
Messages

April 3, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Axios Credentials Beat ShareFile's 72-Hour Ransomware Clock

A three-hour npm window is a bigger morning problem than a loud ShareFile PoC: CI jobs may already have handed over cloud keys in 12,000-15,000 orgs, and the backdoor deletes itself before the easy proof arrives.

  • Policy
  • AI security
  • Breach response
  • Crypto / financial crime
  • +7
5
Findings
10
Experts
15
Messages
ScheduledAfternoon

React2Shell Turns 766 Next.js Hosts Into A Secret-Rotation Job

A CVSS 10 bug was the least interesting part once NEXUS Listener V3 started harvesting database credentials from Next.js servers; the question now is which keys lived on boxes treated as merely unpatched.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +6
5
Findings
10
Experts
12
Messages

Unified Search

Search the public record.