Roundtable Archive

Every public Roundtable, on the record.

The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.

Open the Ledger →How it works →RSS: public Roundtable sessions and Decision Records →Podcast RSS: daily edition audio →
Latest on recordOctober 23, 2026
Scheduled · Morning edition
Previously Exposed PHP Systems Come Offline Without Proof They Are Clean
5Findings11Experts18Messages
405
Roundtables convened
4,214
Expert seats taken
Apr–Oct
2026 on record
2
Editions / day
Cadence · Mar → Oct

Last 7 days

What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.

9
Sessions
52
Findings
24
Records published

Threat domains covered · click to filter this week

Filter the archive · applies instantlyNo filters active · showing all editions
Edition
Source
Showing 321–340 of 405 Roundtables
Sort

May 13, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Shai-Hulud Beats SLSA Build L3 Without Breaking The Crypto

The checks teams added after the last npm scares now green-light the attack: 403 malicious versions carried verifiable provenance because GitHub Actions OIDC was the path in, not the lock on the door.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +8
5
Findings
11
Experts
16
Messages
ScheduledAfternoon

Dynamics 365 On-Prem Beats Patch Tuesday After Exploitation Reports

An ERP box with unauthenticated RCE is not waiting for the weekend bundle. Windows News reports CVE-2026-42833 exploitation; the Cobalt Strike trail remains unconfirmed.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
4
Findings
10
Experts
14
Messages

May 12, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

TanStack Beats The AI Zero-Day: Rotate CI/CD Secrets Today

The story everyone will repeat is the first zero-day an AI found on its own — but the panel's actual move was smaller and due today: a TanStack compromise may have dropped router_init.js and tanstack_runner.js onto your CI runners. Rotate t...

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +7
6
Findings
11
Experts
15
Messages
ScheduledAfternoon

PHP SOAP Jumps MOVEit: The Patch Is Easier Than Finding The Endpoint

CVE-2026-6722 has fixes, but forgotten B2B and ERP SOAP services do not appear in tidy asset lists. That made discovery the real race, while MOVEit Automation stayed a patch-this-week job.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
6
Findings
10
Experts
16
Messages

May 11, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

GhostLock Leaves EDR Behind; SMB File Servers Need Tripwires Today

The usual ransomware alarms are the wrong layer here: GhostLock uses Windows exclusive locks to make SMB files unavailable without encrypting them. The call was to watch storage telemetry, not wait for EDR to learn the trick.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
14
Messages
ScheduledAfternoon

1,800 Unauthenticated MCP Servers Outrank Poland’s Russian Water-Plant Warning

Production write access through unauthenticated MCP servers is a risk defenders can prove today; Poland’s five-plant Russian sabotage warning is grave, but for most readers it changes less by 5 p.m.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
16
Messages

May 10, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Chrome's 4GB Gemini Nano Install Becomes Today's DLP Problem

A browser update, not a breach, forced the sharper call: Chrome quietly placed a 4GB local model on managed endpoints, and the risk is whether DLP and EU consent controls even see the new payload.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
6
Findings
10
Experts
18
Messages
ScheduledAfternoon

AI-Built Apache PoC Puts Emergency Patching Ahead Of The CAB

The Apache httpd claim is still a researcher assessment, not an Apache confirmation. The turn is the clock: a working CVE-2026-23918 PoC reportedly took about 40 minutes, making normal change windows the argument.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
4
Findings
10
Experts
14
Messages

May 9, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Reported Polish Water Intrusions Put Chlorine Controls Ahead Of Attribution

If the ABW reporting holds, the issue is not whose flag to pin on it but who could change chlorine dosing or pressure at five Polish water plants. The room treated proxy ambiguity as a NATO problem, not a reason to wait.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
4
Findings
10
Experts
15
Messages
ScheduledAfternoon

No Patch By May 9: PAN-OS User-ID Portals Come Off The Internet

A federal clock may expire before Palo Alto ships fixes, leaving exposed User-ID portals as both compliance problem and intrusion scene. The reported May 9 date pushed the call from patch planning to cutting internet access now.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
15
Messages

May 8, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Ivanti EPMM Patch Does Not End The Compromise; Rotate Admin Credentials

Patching Ivanti EPMM only closes the door attackers are using now; Belgium's CCB says the admin credentials may have come from January compromises, so the password reset is part of the fix.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
6
Findings
10
Experts
14
Messages
ScheduledAfternoon

Wrong CVE, Real PAN-OS Zero-Day: Start The Hunt Before May 13

A CISA entry labeled as Ivanti points to CVE-2026-0300 instead: an unpatched PAN-OS root RCE Unit42 says may have been exploited since April 9. The patch is later; the compromise window is now.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
14
Messages

May 7, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

NVIDIA Ampere Rowhammer Beats Argo While Cloud IOMMU Proof Is Missing

A lab attack outranked a public Argo CD PoC because three teams now take NVIDIA Ampere GDDR6 bitflips to host root. The hard question is whether AWS, Azure or GCP enforce IOMMU on GPU instances.

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +6
6
Findings
11
Experts
15
Messages
ScheduledAfternoon

Claude Reportedly Picks SCADA; OT MFA Beats AI Self-Replication Alarms

A live intrusion at a Mexican water utility beat the lab shock: Dragos says Claude identified a SCADA interface and suggested password spraying. The actionable call was exposed OT logins, not waiting for AI self-replication to leave control...

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
7
Findings
10
Experts
20
Messages

May 6, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

No Patch Until May 13: PAN-OS Authentication Portals Come Offline

The firewall is the credential choke point, and this one may give root from a single packet. With PAN-OS 10.2 lacking even a signature until May 28, outage beats compromise.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
6
Findings
10
Experts
17
Messages
ScheduledAfternoon

Reported Itron Access To Utility Systems Beats The Morning PAN-OS Alarm

The firewall hole had the morning; the harder question is whether Itron’s breach reached utility-hosted AMI systems serving 112 million devices. The reporting is credible, not confirmed, and that uncertainty is the operational problem.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
15
Messages

May 5, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

DigiCert Revocations Beat Vect Wiper After Support Chat Hack

A support-chat compromise would be bad enough; a Defender update reportedly flagging legitimate DigiCert root certificates made the cleanup uglier. Even Vect 2.0’s 128KB wiper line lost to fixing code-signing trust.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
11
Messages
ScheduledAfternoon

Medtronic's Reported 9M Breach Leaves Pump Firmware Signing In Question

A data-theft claim became an IoMT problem because hospitals cannot yet tell whether Medtronic diabetes firmware-signing systems were touched. The 60-day HIPAA clock may also be running toward mid-June.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
5
Findings
10
Experts
15
Messages

May 4, 2026

2 editions · morning + afternoon
View date →
ScheduledMorning

Copy Fail Beats DeFi Panic: Admins Blacklist algif_aead Today

A market-wide DeFi scare was loud, but the operational call was quieter: CVE-2026-31431 gives attackers a container-escape path through AF_ALG before the May 15 KEV clock runs out.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +7
5
Findings
11
Experts
16
Messages
ScheduledAfternoon

FreeBSD dhclient Payloads Survive The Patch In Lease Files

A DHCP lease can bring the payload back after the fix, so patch-and-reboot is the wrong muscle memory. The file to care about is /var/db/dhclient.leases — and the extra step changes the outage call.

  • Policy
  • AI security
  • Breach response
  • CVE
  • +7
7
Findings
10
Experts
20
Messages

Unified Search

Search the public record.