Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
May 23, 2026
Drupal SQLi Leaves The Warning Phase: Patch Now Or Assume Compromise
A five-day CISA clock is the soft version of the call. Reported PoCs and JSON:API probing were not independently corroborated, but unpatched Drupal with PostgreSQL now gets treated as a live incident.
- 6
- Findings
- 10
- Experts
- 15
- Messages
An EOL F5 BIG-IP In Azure Becomes The Front Door To Confluence And AD
The weak link was not a zero-day but a box everyone had learned to trust. Microsoft’s chain ran from an end-of-life BIG-IP VM to SSH, Confluence secrets, and then AD — the kind of hybrid shortcut that survives a cloud migration.
- 5
- Findings
- 10
- Experts
- 16
- Messages
May 22, 2026
SonicWall Gen6 Firmware Loses To Six LDAP Steps And A 60-Minute Clock
A green scanner result can still leave Gen6 VPNs exploitable: the MFA bypass survives firmware-only work, and brokers are reportedly moving from access to ransomware in 30–60 minutes.
- 6
- Findings
- 10
- Experts
- 14
- Messages
Apex One Admin Moves Behind A Jump Host Before Ransomware Kills EDR
The CVSS 6.7 score is the trap: CVE-2026-34926 needs admin on the Apex One server, but exploitation shows attackers using that foothold to turn the management console against endpoint defenses before ransomware.
- 5
- Findings
- 11
- Experts
- 16
- Messages
May 21, 2026
ValleyRAT’s Reportedly Public Rootkit Builder Jumps The Tomcat Patch Race
The loud patch queue lost to a quieter problem: Check Point says a ValleyRAT builder has been public since early 2025, putting kernel persistence and EDR evasion beyond the original operators.
- 7
- Findings
- 11
- Experts
- 16
- Messages
Fox Tempest’s 1,000 Revoked Certs Still Send Teams Hunting Today
Microsoft says Fox Tempest’s signing service is down; the room did not treat that as closure. Early certificates may not be fully caught in revocation lists, which makes signed ransomware payloads the live problem.
- 5
- Findings
- 10
- Experts
- 17
- Messages
May 20, 2026
npm install Loses To npm ci After Mini Shai-Hulud Hits Hundreds Of Packages
A lockfile was the comfort blanket; the May 19 burst took it away. Researcher reporting ties hundreds of malicious packages to the compromised 'atool' npm account, leaving any pipeline that ran npm install with semver ranges exposed.
- 6
- Findings
- 12
- Experts
- 17
- Messages
43-Day Patching Loses As Exploits Pass Stolen Credentials In Verizon DBIR
A breach model built around stolen passwords no longer matches Verizon's numbers: exploitation is now 31% of confirmed breaches, while median patching sits at 43 days. The hard question is what buys time without becoming the plan.
- 7
- Findings
- 11
- Experts
- 19
- Messages
May 19, 2026
CISA’s Reported GitHub Secret Leak Gets Treated As Compromise
A public repo is the wrong place to ask for benefit of the doubt. CISA says it has no indication of compromise, but six months of reported GovCloud admin keys and passwords pushed responders toward assuming use.
- 5
- Findings
- 11
- Experts
- 13
- Messages
PostgreSQL pgcrypto Beats Entra Breach After Reported RCE PoC
A PostgreSQL extension common in managed databases now has a reported public path from ordinary DB access to OS commands. The chain is not fully confirmed, which is why the call is uncomfortable.
- 5
- Findings
- 11
- Experts
- 14
- Messages
May 18, 2026
NGINX CVE-2026-42945 RCE Alarm Loses Its Proof, But Not Its Patch
A public PoC still makes CVE-2026-42945 a patch-now NGINX bug; what changed was the evidence. The web-shell trail belongs to nginx-ui, not confirmed core NGINX RCE.
- 6
- Findings
- 11
- Experts
- 18
- Messages
LiteLLM Leaves Production After Pwn2Own Finds A Second Way In
The AI gateway was not just another contest bug: Security Affairs reports a Pwn2Own SSRF-to-code-injection chain in the same LiteLLM already caught in TeamPCP's April supply-chain campaign. That made isolation the cleaner bet than waiting f...
- 6
- Findings
- 10
- Experts
- 14
- Messages
May 17, 2026
Passwordless Fuel Monitors Beat The Iran Blame Game At US Sites
Fuel tanks do not care whether the operator was Tehran-linked or opportunistic: a passwordless ATG can hide leaks and fake environmental readings. The hard question is why those gauges are still reachable from the internet.
- 6
- Findings
- 10
- Experts
- 19
- Messages
Fancy Bear's Reported TOTP Seed Theft Pushes FIDO2 Ahead Of Resets
A stolen TOTP seed is not a phished code; it lets attackers mint fresh logins after a password reset. The room split on APT28's NATO-flank campaign until the Roundcube seed theft became the deciding fact.
- 5
- Findings
- 10
- Experts
- 14
- Messages
May 16, 2026
No Patch For Exchange OWA: Mitigation Beats Waiting For Microsoft
A crafted email can hijack an authenticated OWA session and reach EWS before Microsoft ships a permanent fix. EEMS M2.1.x is the control of record, not a placeholder.
- 6
- Findings
- 10
- Experts
- 18
- Messages
YellowKey Makes TPM-Only BitLocker A Physical-Access Problem
The quiet zero-day beat louder reruns because the failure mode is concrete: a USB boot and public GitHub code can decrypt TPM-only Windows 11 disks. TPM+PIN remains a line of defense, but seized or inspected laptops are the pressure point.
- 5
- Findings
- 10
- Experts
- 17
- Messages
May 15, 2026
Reported NGINX Root Chain Beats Cisco's CVSS 10 As Logs May Stay Clean
A CVSS 10 Cisco bug in KEV would usually own the morning; today it did not. The reported NGINX chain has a public PoC, a path from one HTTP request to root, and little conventional evidence left behind.
- 7
- Findings
- 11
- Experts
- 18
- Messages
No Race, No Wait: Fragnesia Hands Local Linux Attackers Root
A reported 79,000-instance Next.js toolkit looked like the Friday fire; the harder call was Linux. Fragnesia’s public PoC needs no race, and OT boxes that cannot patch may be choosing between blacklisting ESP/RXRPC and carrying root risk.
- 5
- Findings
- 10
- Experts
- 12
- Messages
May 14, 2026
PAN-OS Beats The NGINX PoC: Four Critical Bugs, No Single Fix
A firewall fleet can look patched and still be exposed: Palo Alto has four simultaneous PAN-OS CVEs, CVE-2026-0300 reportedly exploited, and no single release closes the set.
- 6
- Findings
- 10
- Experts
- 13
- Messages
Siemens Ruggedcom APE1808 Turns PAN-OS Into A Substation Problem
The firewall crisis no longer stops at the firewall. Siemens says Ruggedcom APE1808 is affected, putting a Purdue Level 3.5 host between corporate WAN and SCADA networks in the same reported PAN-OS exploitation story.
- 6
- Findings
- 10
- Experts
- 16
- Messages