Roundtable Archive

Every public Roundtable, on the record.

The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.

Open the Ledger →How it works →RSS: public Roundtable sessions and Decision Records →Podcast RSS: daily edition audio →
Latest on recordOctober 23, 2026
Scheduled · Morning edition
Previously Exposed PHP Systems Come Offline Without Proof They Are Clean
5Findings11Experts18Messages
405
Roundtables convened
4,214
Expert seats taken
Apr–Oct
2026 on record
2
Editions / day
Cadence · Mar → Oct

Last 7 days

What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.

9
Sessions
52
Findings
24
Records published

Threat domains covered · click to filter this week

Filter the archive · applies instantlyNo filters active · showing all editions
Edition
Source
Showing 61–80 of 405 Roundtables
Sort

September 11, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Exposed NetScaler Gateway and AAA Deployments Cannot Wait Another Night

Citrix has reported CVE-2026-19490 affecting NetScaler Gateway or AAA configurations, and CISA's KEV catalog now lists the flaw. Practitioners made internet-facing deployments tonight's first priority, requiring compromise review alongside...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +7
6
Findings
12
Experts
18
Messages
ScheduledMorning

Artifactory Promotion Stops Short of a Blanket Release Freeze

Wiz reports attackers are actively chaining three JFrog Artifactory flaws, putting downstream software at risk if they gain administrative control. Practitioners halted promotion only from affected Artifactory paths, rejecting a blanket fre...

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +7
5
Findings
11
Experts
16
Messages

September 10, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

WatchGuard Fireboxes Come Offline When Exploitation Cannot Be Ruled Out

WatchGuard reports exploitation attempts against Firebox CVE-2025-14733, while BleepingComputer, citing CISA, reports a ransomware link. Practitioners favored a clean, fixed replacement over patching in place whenever exploitation cannot be...

  • Policy
  • Breach response
  • Cloud
  • Crypto / financial crime
  • +7
8
Findings
10
Experts
19
Messages
ScheduledMorning

Cisco FMC Comes Offline Before Managed Firewalls Are Trusted Again

Cisco Talos reports active exploitation of CVE-2026-20079 in Cisco Secure Firewall Management Center, with attackers gaining root access, persisting and stealing credentials; CISA lists the flaw in KEV. Practitioners called for affected FMC...

  • Malware
  • Policy
  • Breach response
  • Cloud
  • +6
5
Findings
10
Experts
16
Messages

September 9, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

CISA’s KEV Listing Pulls Exposed N-Central Offline Today

N-able says CVE-2026-86218 allows remote code execution before login in on-premises N-central, while CISA’s KEV catalog confirms exploitation but gives no scale, victims or attribution. Exposed servers come offline until upgraded and checke...

  • Policy
  • Supply chain
  • Breach response
  • Cloud
  • +8
6
Findings
12
Experts
18
Messages
ScheduledMorning

F5 BIG-IP Upgrades Lose to Forensic Validation or Full Rebuilds

According to F5 and Sophos, exploitation of CVE-2025-53521 has deployed a Linux rootkit on BIG-IP APM systems, and the implant can persist after an upgrade. Practitioners rejected upgrade-only recovery in favor of isolation, forensic valida...

  • Malware
  • Policy
  • AI security
  • Breach response
  • +9
5
Findings
13
Experts
18
Messages

September 8, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

BigBear 2.0 Remains the Leading Enterprise Risk

BigBear 2.0 reportedly targeted 461 organizations, though that figure does not prove all 461 were compromised. The risk remains first in the queue, and practitioners called for preserving Microsoft 365 evidence and revoking BigBear-linked s...

  • Policy
  • Supply chain
  • Breach response
  • Cloud
  • +7
5
Findings
11
Experts
16
Messages
ScheduledMorning

Rogue ScreenConnect Clients Outrank an Unproven Server RCE

ConnectWise advised customers to disable file transfers in its ScreenConnect remote-support software, taking a routine support channel offline. Practitioners judged the activity a chain involving legitimate transfers and rogue or modified c...

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +8
6
Findings
12
Experts
18
Messages

September 7, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

MikroTik Account or Key Drift Triggers a Rebuild, Not a Patch

CERT Polska reports attackers abusing MikroTik RouterOS CVE-2026-67276 with CVE-2026-86060, putting router accounts, keys and configurations at risk. Practitioners kept patching urgent but backed rebuilds where external records show unautho...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +7
5
Findings
12
Experts
13
Messages
ScheduledMorning

Sansec-Reported StyleSmuggler Exploitation Makes Magento GraphQL Blocking Critical

Sansec reportedly identified active StyleSmuggler exploitation through Magento/Adobe Commerce GraphQL processing. The room made GraphQL blocking at the edge and origin critical, alongside isolating suspect Commerce nodes and preserving evid...

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +8
5
Findings
12
Experts
19
Messages

September 6, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

A Clean Source Repo Does Not Clear ChainDrop's Published npm Tarball

Microsoft and Snyk corroborate a ChainDrop npm tampering mechanism that can make a published package differ from its source repository, putting build systems and reachable secrets at risk; StepSecurity alone reports the campaign’s scale. Pr...

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +6
5
Findings
10
Experts
15
Messages
ScheduledMorning

Exposed PaperCut Comes Offline Before Responders Prove Compromise

CISA lists PaperCut CVE-2026-81578 and CVE-2026-82078 in its Known Exploited Vulnerabilities catalog, while Huntress and Arctic Wolf report attacks reaching SYSTEM, collecting credentials and creating privileged accounts. Practitioners chos...

  • Policy
  • Supply chain
  • Breach response
  • Crypto / financial crime
  • +6
5
Findings
10
Experts
17
Messages

September 5, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Citrix Jumps the Queue, but Traffic Alone Does Not Prove a Breach

According to the session’s source pack, Citrix NetScaler CVE-2026-19490 is an authentication bypass affecting internet-facing appliances; exploit-like traffic alone does not establish a breach. Practitioners prioritized containment but requ...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +7
5
Findings
12
Experts
20
Messages
ScheduledMorning

Internet-Exposed Switchvox Comes Offline Before Patching Starts

The session’s source pack reports active exploitation of Sangoma Switchvox CVE-2026-9586, which CISA’s KEV catalog lists; internet-facing phone systems risk database access and remote code execution. Practitioners would take exposed boxes o...

  • Policy
  • Supply chain
  • Breach response
  • Crypto / financial crime
  • +6
6
Findings
10
Experts
18
Messages

September 4, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Exposed N-central Jumps the Queue, Pending Ransomware Verification

Reported N-central exploitation and ransomware activity have put internet-exposed systems under scrutiny, but the applicable advisory, affected releases and vulnerability mapping remain unverified. Practitioners moved exposed N-central to t...

  • Policy
  • AI security
  • Breach response
  • Cloud
  • +8
5
Findings
11
Experts
15
Messages
ScheduledMorning

Fortinet CVE-2024-55591 Leads Isolation and Compromise Hunts

CISA’s Known Exploited Vulnerabilities catalog and reporting reviewed by the room support active-compromise triage for exposed FortiOS and FortiProxy paths affected by CVE-2024-55591. Isolation takes priority, followed by VPN credential rev...

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +8
5
Findings
12
Experts
18
Messages

September 3, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Artifactory Publishing Stops Until Its Artifacts Earn Trust Again

BleepingComputer reports attackers are exploiting JFrog Artifactory CVE-2026-82329 to forge administrator tokens, putting repositories and the pipelines that consume their artifacts at risk. Practitioners called for publishing to stop rathe...

  • Malware
  • Policy
  • Breach response
  • Cloud
  • +7
5
Findings
11
Experts
15
Messages
ScheduledMorning

Teams Support Calls Need A Second Channel Before Remote Control

Microsoft documented attackers posing as IT support in external Teams chats, persuading users to approve remote access and then using PowerShell and a Node.js implant to gain broader enterprise access. Practitioners called for remote-contro...

  • Policy
  • Supply chain
  • Breach response
  • Crypto / financial crime
  • +7
5
Findings
11
Experts
14
Messages

September 2, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Langflow Comes Offline Before Anyone Rotates Affected Credentials

According to SecurityAffairs and SecurityWeek, attackers are actively exploiting Langflow CVE-2026-0768, putting application, AI-service, cloud and SSH credentials at risk on systems through version 1.4.2. Practitioners put isolation and ev...

  • Malware
  • Policy
  • AI security
  • Cloud
  • +7
5
Findings
12
Experts
18
Messages
ScheduledMorning

Virtualizor Updates Stop; August 28–30 Hosts Need a Compromise Hunt

Virtualizor says malicious updates reached some installations from August 28 through 30, while incomplete vendor logs leave no definitive victim list. Practitioners suspended updates and put every host active in that window under scrutiny,...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +7
5
Findings
12
Experts
18
Messages

Unified Search

Search the public record.