Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
May 3, 2026
GitHub Enterprise Server RCE Beats Conduent’s Reported 25 Million Records
A breach reportedly touching 25 million Americans would usually own the morning. It lost to a GitHub Enterprise Server flaw where push access can become full server compromise, with Wiz’s 88% unpatched figure treated as a warning, not a fac...
- 5
- Findings
- 10
- Experts
- 20
- Messages
Canvas Admins Revoke Tokens Before ShinyHunters Proves Its Claim
The figures are still ShinyHunters’ numbers, not Instructure’s. With a May 6 deadline and school records in play, Canvas OAuth tokens and API keys were treated as exposed before the proof arrives.
- 5
- Findings
- 10
- Experts
- 13
- Messages
May 2, 2026
security.ubuntu.com DDoS Blocks Copy Fail Patching During Exploitation
Apt is the choke point: millions of Ubuntu hosts reportedly cannot reach security.ubuntu.com while Copy Fail is in KEV and under live abuse. The outage turns patching into a mirror decision, not a maintenance window.
- 7
- Findings
- 10
- Experts
- 18
- Messages
Ubuntu Mirrors Beat Canonical Feeds After 24 Hours Of Copy Fail Blocking
Copy Fail exploit code is public, but the usual Ubuntu path is still failing after 24 hours. The fight moved from patch-now urgency to whether teams can trust and scale mirrors before attackers get the same window.
- 5
- Findings
- 10
- Experts
- 16
- Messages
May 1, 2026
Mini Shai-Hulud Turns Claude Code And VS Code Hooks Into Persistence
Token theft was the old problem; the new one is a reactivation path inside the developer tools defenders trust. Claude Code SessionStart hooks and VS Code tasks can bring Mini Shai-Hulud back where EDR and SAST often are not looking.
- 5
- Findings
- 10
- Experts
- 16
- Messages
LayerZero's 1-Of-1 DVN Default Beats The $577M Lazarus Label
DPRK attribution matters, but the live question is whether KelpDAO's path is sitting in other bridges: Chainalysis says about 47% of LayerZero OApps may share the same 1-of-1 DVN setup.
- 5
- Findings
- 12
- Experts
- 13
- Messages
April 30, 2026
SAP npm Stealer Outranks Exploited LiteLLM With Reported 572,000 Downloads
LiteLLM is already being exploited, but the quieter fire is four SAP CAP npm packages with reportedly 572,000 weekly downloads and a Bun stealer reaching for cloud tokens, npm creds and kubeconfigs.
- 8
- Findings
- 10
- Experts
- 16
- Messages
No Patch Window Left: cPanel Reportedly Comes Offline Under Exploit Pressure
This stopped being a patch advisory once tenants could lose the panel that runs DNS, mail and databases. watchTowr’s public PoC turns cPanel CVE-2026-41940 into commodity pressure, while reported provider shutdowns make continuity the live...
- 4
- Findings
- 10
- Experts
- 13
- Messages
April 29, 2026
cPanel Beats Claude: Shared Hosting Gets Patched Or Firewalled Tonight
The AI-supply-chain first is the story everyone wants to argue about; cPanel is the box practitioners have to touch before morning. Namecheap reportedly shut 2083/2087 while it patched.
- 5
- Findings
- 12
- Experts
- 22
- Messages
No Patch For LeRobot: Robot Controllers Come Off The Network
A pickle bug in unauthenticated gRPC is not another model-server cleanup: on LeRobot, the prize is actuator control and there is no vendor fix yet. The question is whether any exposed robotics policy server can stay reachable.
- 5
- Findings
- 10
- Experts
- 16
- Messages
April 28, 2026
Alleged TeamPCP Triple Hit Beats CODESYS As Secrets Move First
Three supply-chain paths put developer credentials in play at once, while the CODESYS safety risk waits on still-murky version scope. The call turns on what teams can prove and rotate this morning.
- 5
- Findings
- 11
- Experts
- 14
- Messages
Cisco vManage Rebuild Beats Patch-Only Fix For Utility SD-WAN Chain
A patch-only response leaves the fabric suspect. CISA’s ED 26-03 calls for fresh vManage, vSmart and vBond images after Talos tied the three-CVE chain to UAT-8616 against infrastructure serving thousands of utility clients.
- 5
- Findings
- 10
- Experts
- 15
- Messages
April 27, 2026
Breeze Cache RCE Jumps The Queue As Telegram PoC Opens WordPress Sites
The caveat that the risky setting was disabled by default did not survive contact with telemetry. With a public PoC on Telegram and ransomware crews moving in the same window, Breeze Cache became today’s patch-now problem.
- 5
- Findings
- 12
- Experts
- 17
- Messages
Angelo Martino's Guilty Plea Walls Off Ransomware Negotiators From Insurance Limits
The betrayal landed inside the team victims hire after the breach: a negotiator had both the insurer's ceiling and the attacker's ear. Practitioners treated Angelo Martino's plea as proof that ransomware response now needs internal blast do...
- 5
- Findings
- 10
- Experts
- 16
- Messages
April 26, 2026
Checkmarx KICS Poisoning Makes The Scanner The Suspect In CI/CD
A scanner embedded in CI/CD is supposed to find poison, not ship it. Checkmarx KICS images and VS Code extensions were compromised before a separate LAPSUS$ claim, leaving toolchain credentials as the live question.
- 5
- Findings
- 12
- Experts
- 16
- Messages
Checkmarx Breach Claim Loses To A Single-Source Evidence Gap
A leak-site post is not a supply-chain crisis on its own. The Checkmarx corporate breach case rests on RedPacket Security’s April 25 listing alone: no samples, no Checkmarx acknowledgment, no second source.
- 5
- Findings
- 11
- Experts
- 15
- Messages
April 25, 2026
Hardcoded Keys Put 20,000 Lantronix And Silex Boxes Beyond Patching
The ugly part is not that OT gear needs patches; it is that forged firmware can look legitimate. BRIDGE:BREAK puts 20,000 serial-to-IP converters between plant floors and IP networks in the category responders hate: boxes they may have to i...
- 5
- Findings
- 12
- Experts
- 12
- Messages
IKEv2 RCE Jumps Patch Tuesday Queue; Azure IoT Central Waits
The loud Azure IoT Central item is service-side; the exposed box in your estate is VPN. CVE-2026-33824 is unauthenticated RCE on UDP 500/4500, with BlueHammer close behind in CISA KEV.
- 5
- Findings
- 10
- Experts
- 13
- Messages
April 24, 2026
Bitwarden CLI Turns Stolen npm Tokens Into A Package-Republishing Worm
The bad package is only the start: in 93 minutes, stolen npm tokens may have republished malware into 200–500 downstream packages. The work now moves to what each infected developer could publish.
- 5
- Findings
- 10
- Experts
- 11
- Messages
PSAPs Lock Intrado 911 EGW Management To Bastions Before Patching
The npm-and-PyPI worm was the loud story; the panel put the 911 network first. Intrado's Emergency Gateway sits one management-plane mistake away from the calls it routes — so move its admin access behind a bastion before you patch, and lea...
- 5
- Findings
- 10
- Experts
- 12
- Messages