Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
September 29, 2026
NetScaler Stays First After CISA Adds Both Flaws to Its KEV Catalog
CISA added Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 to its KEV catalog after confirming exploitation; reported webshell persistence means an internet-facing appliance may remain compromised after patching. Practitioners kept NetSc...
- 5
- Findings
- 12
- Experts
- 18
- Messages
September 28, 2026
NetScaler Patching Comes With A Compromise Hunt, Not After One
Citrix says in advisory CTX697096 that attackers are actively exploiting two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, and has issued fixes for affected ADC and Gateway appliances. Practitioners treated patching and compromise...
- 5
- Findings
- 11
- Experts
- 18
- Messages
On Exposed NetScaler Appliances, Evidence Comes Before The Patch
Citrix and CISA report that CVE-2026-88771 and CVE-2026-88772 were exploited before fixes, leaving previously exposed NetScaler appliances at risk of undetected compromise after patching. Practitioners put evidence preservation and compromi...
- 5
- Findings
- 10
- Experts
- 17
- Messages
September 27, 2026
NetScaler Loses Unneeded Internet Exposure Before The Flaws Are Clear
Citrix NetScaler ADC/Gateway appliances are reportedly being exploited through unpatched flaws, but the number and scope of those flaws—and the indicators needed to find intrusions—remain unclear. Practitioners put exposure reduction ahead...
- 5
- Findings
- 11
- Experts
- 15
- Messages
CyberBrief Reports a PeopleSoft WAF Bypass; Patching Alone Loses
Reporting summarized by CyberBrief describes attackers exploiting Oracle PeopleSoft CVE-2026-35273 through an encoded PSEMHUB path that can evade literal-path web application firewall rules, then persist and steal credentials. The room made...
- 5
- Findings
- 12
- Experts
- 15
- Messages
September 26, 2026
Oracle PeopleSoft CVE-2026-35273 Jumps Queue on Google-Linked Exploitation Report
According to Google-linked reporting summarized in the briefing, attackers reportedly bypassed temporary web application firewall controls for Oracle PeopleSoft CVE-2026-35273 and installed web shells. The room puts PeopleSoft first, conclu...
- 5
- Findings
- 12
- Experts
- 18
- Messages
September 25, 2026
Check Point Stays First: Preserve VPN Evidence Before Patching
Reported exploitation of Check Point CVE-2026-85102 and CVE-2026-93616 puts VPN and management interfaces at risk of attacker access. Practitioners kept Check Point ahead of WSO2 and F5, putting preservation of VPN and management evidence b...
- 7
- Findings
- 12
- Experts
- 18
- Messages
September 24, 2026
BSI Reports Unauthorized Check Point VPN Sessions; Patching Alone Loses
Germany’s BSI reports that attackers exploited Check Point CVE-2026-85102 and CVE-2026-93616 to open unauthorized VPN sessions and scan directories; CISA added both flaws to its Known Exploited Vulnerabilities catalog. Practitioners rejecte...
- 5
- Findings
- 12
- Experts
- 18
- Messages
Water Utility PLC Changes Trigger Safety Response Before Blame
The session’s source pack reports PLC password and IP-address changes, operator lockout and service effects at water facilities, putting control of physical processes at risk. Practitioners said any site seeing those signs faces a safety in...
- 7
- Findings
- 12
- Experts
- 18
- Messages
September 18, 2026
Cisco ISE Jumps The Queue: Compromise Means Rebuild Rather Than Patch
CISA’s KEV catalog lists Cisco ISE flaw CVE-2026-76460, and Cisco’s advisory identifies ISE and ISE-PIC as affected; a compromised appliance that brokers access can no longer be trusted. Practitioners rejected patch-only recovery: any box s...
- 5
- Findings
- 11
- Experts
- 18
- Messages
September 17, 2026
ScreenConnect Goes First; Downstream Compromise Still Needs Proof
ConnectWise says ScreenConnect versions before 26.6.5 are vulnerable to CVE-2026-84869, and CISA lists the flaw in its Known Exploited Vulnerabilities catalog; its remote-management role could put customer access at risk. The room put Scree...
- 5
- Findings
- 11
- Experts
- 18
- Messages
Cisco Secure Email Gateway Jumps The Queue As CISA's Deadline Lands
Cisco confirmed exploitation of CVE-2026-76461 in Secure Email Gateway, and CISA’s Known Exploited Vulnerabilities catalog sets its remediation deadline for today. Practitioners made the upgrade the day’s first job rather than treating the...
- 5
- Findings
- 11
- Experts
- 15
- Messages
September 16, 2026
Active Directory Certificate Hunting Beats Another Password Rotation
Microsoft’s updated Active Directory guidance says certificate abuse can create persistence that survives user-password resets and rotation of the domain’s core Kerberos key. Practitioners put certificate changes and shadow credentials ahea...
- 5
- Findings
- 11
- Experts
- 18
- Messages
Internet-Exposed FortiGate Jumps The Queue Without Full 3BB Confirmation
Third-party reporting on 3BB describes deep attacker access after exploitation of FortiGate CVE-2024-21762, though 3BB has not publicly confirmed every detail. Practitioners put affected, reachable FortiGate appliances ahead of vCenter beca...
- 6
- Findings
- 12
- Experts
- 16
- Messages
September 15, 2026
Cisco Gateway Response Waits On A Verified CVE-2026-76461 Advisory
The source pack links Cisco Secure Email Gateway CVE-2026-76461 to active exploitation and root-command execution, but those claims were not verified against Cisco or CISA advisories. Practitioners put that check ahead of patching or huntin...
- 5
- Findings
- 12
- Experts
- 20
- Messages
Process Safety Beats The AI Story In Internet-Exposed PLC Response
The Canadian Cyber Centre reports an AI-assisted campaign targeting internet-exposed industrial PLCs, putting physical processes at risk if remote access reaches controller operations. Practitioners put safe containment ahead of debating AI...
- 5
- Findings
- 12
- Experts
- 16
- Messages
September 14, 2026
ScreenConnect Beats Check Point—Direct OT Access Can Flip The Order
CISA’s KEV catalog lists exploited flaws in ConnectWise ScreenConnect, MikroTik RouterOS and JFrog Artifactory, while the Dutch NCSC says exploitation of Check Point VPN CVEs 2026-85102 and 2026-85103 is anticipated. Practitioners put Scree...
- 5
- Findings
- 13
- Experts
- 18
- Messages
September 13, 2026
Cisco FMC Hotfixes Lose To Rebuilds When Compromise Persists
Cisco reporting summarized for the session says CVE-2026-20079 is being actively exploited in Secure Firewall Management Center and that a hotfix alone does not eradicate compromise. Practitioners would not close the case at patching; signs...
- 5
- Findings
- 10
- Experts
- 15
- Messages
GitHub Actions Jumps The Queue. Patch Counts Alone Can Wait.
Five reported attacks across development ecosystems put CI runners, OIDC tokens, maintainer endpoints and publishing identities at risk, including GitHub Actions workflows. Practitioners ranked that shared route into builds and releases abo...
- 5
- Findings
- 11
- Experts
- 15
- Messages
September 12, 2026
Anthropic's Claude Abuse Report Leads Without Proving One Campaign
Anthropic reports that threat actors used Claude to find exposed secrets and steal tokens, putting source repositories and connected systems at risk. Practitioners treated that acceleration as the lead story, even as GitLab remained the day...
- 5
- Findings
- 12
- Experts
- 18
- Messages