Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
June 2, 2026
Netlogon Jumps Miasma: One UDP Packet Gets SYSTEM On Domain Controllers
The supply-chain story had novelty, but Active Directory had blast radius. CVE-2026-41089 is already being exploited: unauthenticated CLDAP to UDP 389 can hand SYSTEM on a domain controller.
- 6
- Findings
- 10
- Experts
- 14
- Messages
IRGC-Linked Cyber Isnaad Front Moves From Stolen Data To CO2 Compressors
A food-plant intrusion crossed the line practitioners worry about: Profero’s GRAT matches support the high-confidence link to Emennet Pasargad, and the reported impact reached CO2 compressors rather than stopping at stolen files.
- 6
- Findings
- 11
- Experts
- 15
- Messages
June 1, 2026
Stake DAO Jumps Magento: One Key Rewires LayerZero Trust In 25 Seconds
An unauthenticated Magento RCE looked like the obvious fire. The harder call was Stake DAO: a compromised deployer key reportedly minted 5.4T vsdCRV in 25 seconds, showing how fast bridge trust can become downstream risk.
- 5
- Findings
- 12
- Experts
- 15
- Messages
SpeedX Cannot Prove 840M Azure Logistics Records Went Unread
Azure's default logs do not record anonymous reads, so SpeedX's "no unauthorized access" line cannot carry the 840M-record exposure. For logistics partners, the issue is what cannot be reconstructed.
- 5
- Findings
- 10
- Experts
- 17
- Messages
May 31, 2026
Reported Marimo LLM Agent Puts Host Isolation Ahead Of npm Token Theft
A notebook compromise is being treated as a speed problem, not just another RCE. Sysdig says a Marimo CVE-2026-39987 intruder used an LLM agent to improvise its way to PostgreSQL data, pushing automated containment despite single-source evi...
- 5
- Findings
- 10
- Experts
- 17
- Messages
Carnival's Six-Million-Traveler Breach Becomes A Passport Fraud Case
A stolen passport number ages badly, and Carnival’s notice puts roughly 5,995,277 travelers across six cruise brands in that problem. The firewall work still matters, but this shifted the story from breach notice to identity checks.
- 4
- Findings
- 10
- Experts
- 15
- Messages
May 30, 2026
No Weekend For GlobalProtect: Patch Or Drop Auth Override By June 1
A VPN gateway that accepts forged cookies is a bad place to wait out a weekend. Rapid7 and Palo Alto say CVE-2026-0257 is being exploited, with a reported CISA deadline of June 1.
- 5
- Findings
- 10
- Experts
- 13
- Messages
Grok's Alleged CSAM Images Make Mainstream AI The Abuse Story
A CVSS 9.9 Plesk bug would normally own the afternoon; Grok changed the call. CCDH says the image generator produced alleged CSAM over roughly 11 days, pulling mainstream AI into legal and regulatory jeopardy.
- 5
- Findings
- 10
- Experts
- 16
- Messages
May 29, 2026
No Patch, No Global Kill Switch: Internet-Facing Gogs Comes Offline Today
Disabling signups does not save a Gogs server if any account already exists. With a public Metasploit module and no vendor patch after 72 days, the safe call moved from hardening to isolation.
- 6
- Findings
- 10
- Experts
- 14
- Messages
Trivial Samba RCE Turns Guest Printing Into Patch-Today Work
A print setting most teams stopped thinking about can become unauthenticated command execution. Samba has patches out, but guest printing makes the window feel measured in hours, not days.
- 7
- Findings
- 10
- Experts
- 15
- Messages
May 28, 2026
Glassworm Is Down; 300 Compromised Packages Put Dev Boxes In Scope
A botnet sinkhole does not scrub a CI token. Packages from npm, PyPI and GitHub may already have landed on build hosts, so the takedown turns into a workstation forensics problem.
- 7
- Findings
- 11
- Experts
- 15
- Messages
Silent Ransom Walks Past MFA With USB Drives In Law Firm Offices
A logged-in workstation is now the perimeter failure. FBI says Silent Ransom operatives posing as IT support have put data from 38+ law firms on a leak site, making USB lockdown a physical security problem, not an EDR alert.
- 5
- Findings
- 10
- Experts
- 16
- Messages
May 27, 2026
ABB's CVSS 10 Waits; BioFlo 320 Has No Patch For VNC Access
A hard-coded VNC password on the BioFlo 320 sits at direct process control, where a bad parameter change can wreck a pharma batch and force GMP revalidation. That beats ABB's perfect-score DoS because there is no fix to install.
- 5
- Findings
- 10
- Experts
- 15
- Messages
BadHost Jumps DeFi As Starlette Auth Bypass Hits AI Backends
Crypto losses and DinDoor's Deno chain were not dismissed; BadHost was nearer to operators' blast radius. Starlette sits under vLLM, LiteLLM, MCP servers and FastAPI, where a Host header bug can bypass auth on AI backends.
- 5
- Findings
- 10
- Experts
- 18
- Messages
May 26, 2026
Trend Micro's Patriot Bait Puts Gemini Memory Files First Today
Ghost, TrapDoor and Megalodon were louder repeats; the new risk was quieter and uglier: a reported five-year Gemini jailbreak that lived in persistent memory, not a prompt.
- 5
- Findings
- 10
- Experts
- 17
- Messages
Reported 7-Zip RCE Has No Patch; Untrusted File Workflows Drop It
A file utility became the bigger operational risk than the louder breach stories: the 7-Zip NTFS handler report is still awaiting independent confirmation, but the alleged any-extension trigger left little appetite for letting it open untru...
- 5
- Findings
- 10
- Experts
- 15
- Messages
May 25, 2026
TrapDoor Beats Kali365: The Poison Is Invisible To Code Review
A supply-chain hit is no longer just a bad package: TrapDoor hides zero-width Unicode in .cursorrules and .CLAUDE.md, so the assistant rewrites the risk before review can see it.
- 5
- Findings
- 10
- Experts
- 16
- Messages
Lazarus RemotePE Moves EDR Memory Rules From Backlog To Today
A diskless RAT changes the work from chasing hashes to proving sensors see VirtualAllocEx and friends. For finance and crypto teams, “EDR installed” may still mean blind.
- 5
- Findings
- 10
- Experts
- 9
- Messages
May 24, 2026
cPanel Chain Beats Yesterday’s LiteSpeed Alarm To Shared-Host Root
A bug covered yesterday became a different problem once cPanel entered the chain: reported, not yet independently confirmed, exploitation now points at unauthenticated root on shared hosting boxes that may carry hundreds of tenant sites.
- 7
- Findings
- 10
- Experts
- 14
- Messages
Two Unrelated Packagist Hits Beat Drupal And Charter Replays
A PHP shop could clear Drupal and still be installing a credential stealer: Laravel-Lang tags were rewritten across 700+ versions, while eight other Packagist packages hid malware where Composer scanners may not look.
- 5
- Findings
- 12
- Experts
- 14
- Messages