Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
September 1, 2026
PaperCut Breach Hunt Outranks Five Fresh Afternoon Incidents
Two flaws in PaperCut NG/MF 24.x–26.x pose an immediate compromise risk, the roundtable assessed, citing public exploits and observed intrusions involving data theft. Practitioners kept PaperCut ahead of five fresh cases because exposed pri...
- 5
- Findings
- 13
- Experts
- 17
- Messages
Reported Ruby on Rails Exploitation Turns a Patch Job Into a Breach Hunt
Reports of active exploitation against Ruby on Rails CVE-2026-66066 put applications using vulnerable Active Storage code at risk. Practitioners found the Rails case better corroborated than the day’s Gitea and Linux/JFrog claims and called...
- 4
- Findings
- 13
- Experts
- 19
- Messages
August 31, 2026
Fire Ant Hunt Comes First; Cisco Router Rebuilds Need Local Proof
Researcher reporting reviewed by the panel describes Fire Ant operators taking over Cisco IOS XR routers and suppressing security logs, undermining the systems defenders rely on to spot a breach. Practitioners put an independent hunt across...
- 4
- Findings
- 10
- Experts
- 15
- Messages
Claude Session Revocation Comes Before Password Resets
Reports reviewed in the session describe infostealers hijacking paid Anthropic Claude sessions, creating separate account-access and billing exposure. Practitioners put revoking those sessions and searching affected devices for infostealers...
- 5
- Findings
- 11
- Experts
- 14
- Messages
August 30, 2026
PaperCut Evidence Preservation Comes Before Emergency Patch Release 2
Current reporting indicates attackers are actively exploiting a PaperCut NG/MF flaw after bypassing its initial fix, with logs potentially altered. Practitioners put evidence preservation before Emergency Patch Release 2 for versions 24–26;...
- 5
- Findings
- 10
- Experts
- 15
- Messages
Philippine ownCloud Stays First. Chinese State Attribution Waits
The session materials report sensitive-file theft in a Philippine ownCloud breach and identify versions before 10.13.1 as vulnerable to CVE-2023-49105; OT impact remains unproven. Practitioners kept ownCloud ahead of Ajna v2 but rejected Ch...
- 4
- Findings
- 12
- Experts
- 18
- Messages
August 29, 2026
Linux CVE-2026-53362 Beats PaperCut to Tonight’s First Check
Researcher reporting reviewed by the panel indicates possible exploitation of Linux CVE-2026-53362, with exposed hosts potentially facing root persistence and lateral movement. Practitioners put Linux exposure checks ahead of PaperCut under...
- 5
- Findings
- 12
- Experts
- 18
- Messages
PaperCut Says Patch Again; Huntress's Exploit Chain Puts Hunting First
Huntress observed a PaperCut attack chain, while PaperCut says NG/MF versions 24–26 need Emergency Patch Release 2 even after the first fix; exposed print servers may already be compromised. Practitioners treated this as an investigation, n...
- 5
- Findings
- 12
- Experts
- 18
- Messages
August 28, 2026
Minnesota Water Systems Jump the Queue With Controller Impact Unclear
Reports of disruptions at Minnesota water systems put internet-exposed operational technology and default credentials under scrutiny, but public evidence does not establish controller manipulation at every site. Practitioners still ranked t...
- 5
- Findings
- 12
- Experts
- 18
- Messages
FBI QTFY Domain Seizures Don't Clear Affected Check Point Gateways
The FBI says its QTFY domain seizures removed attacker infrastructure, but Check Point Quantum gateways reportedly exposed through CVE-2024-24919 may remain compromised. Practitioners treated the takedown as no substitute for victim remedia...
- 5
- Findings
- 14
- Experts
- 19
- Messages
August 27, 2026
Water-System PLC Access Stays Under Plant Authority, Not the SOC
According to CISA, attacks have affected more than 100 U.S. water systems; practitioners focused on control configurations, credentials, alarms and safety mechanisms, not conventional data loss. They kept changes to PLC remote-access paths...
- 5
- Findings
- 10
- Experts
- 13
- Messages
LiteLLM Jumps the Queue After Microsoft Observes Compromises
Microsoft observed exposed LiteLLM, RAGFlow and Kestra workloads compromised in incidents involving secret theft, persistence, command execution, data access and cryptomining. Practitioners put that direct evidence ahead of any fixed patch...
- 5
- Findings
- 11
- Experts
- 15
- Messages
August 26, 2026
Production TeamCity Still Outranks the Latest CISA KEV Entries
Reports from Australia’s ASD and JetBrains indicate CVE-2026-63077 is being exploited in TeamCity, putting build credentials, agents and deployment pipelines at risk. Practitioners kept production TeamCity ahead of the latest CISA KEV entri...
- 6
- Findings
- 11
- Experts
- 16
- Messages
UK Confirms One Generator Disruption; 30-Plant Claim Remains Unverified
The UK government confirmed disruption at one small generator, while public evidence has not verified claims that more than 30 U.S. plants were compromised or tied the activity to Iran. Practitioners rejected the campaign-wide leap and focu...
- 5
- Findings
- 11
- Experts
- 17
- Messages
August 25, 2026
Soru: Our ransomware recovery test missed the 24-hour RTO the board approved last year — actual recovery ran 71 hours. Closing that gap properly means a €1.8M capex p
71-Hour Ransomware Recovery and Board Risk Appetite
Board memo — Recommendation, 25 August 2026 Do not approve any of the three options as currently framed. Authorize a ring-fenced 30-day emergency-control tranche, preserve the IAM rollout, and withhold the balance of the €1.8M programme unt...
- 5
- Findings
- 9
- Experts
- 20
- Messages
Oracle HTTP Server Jumps the Queue as CISA Sets August 27 Deadline
CISA’s KEV listing identifies Oracle HTTP Server and WebLogic Proxy Plug-in CVE-2026-21962 as exploited, with an August 27 federal remediation deadline. Practitioners put exposed Oracle systems first where internet reach and business impact...
- 5
- Findings
- 13
- Experts
- 16
- Messages
August 24, 2026
Patch GitLab Now, but Don't Presume a Breach
Reported attempts to exploit GitLab CVE-2026-19478 have appeared in honeypots, putting exposed instances at risk without confirming a victim compromise. Practitioners backed urgent patching but rejected treating every internet-facing server...
- 5
- Findings
- 11
- Experts
- 14
- Messages
MLflow CVE-2026-64849 Leads on Cyber Daily's Exploitation Report; Cloud Abuse Unconfirmed
Cyber Daily reports active exploitation of MLflow CVE-2026-64849, a flaw that can make MLflow reach resources available to its workload identity and return the response; successful metadata access, credential theft, and downstream cloud abu...
- 5
- Findings
- 11
- Experts
- 18
- Messages
August 23, 2026
Panel Prioritizes Coinbase Cartel for Most Enterprises
FortiGuard reports Coinbase Cartel activity affecting more than 60 organizations and the development of ESXi-focused ransomware. The panel identifies persistent identity sessions and tokens as the immediate concern and prioritizes Coinbase...
- 5
- Findings
- 13
- Experts
- 17
- Messages
Mini Shai-Hulud Breaks npm Publication Trust; CI Secrets Are the Open Question
Mini Shai-Hulud is not an ordinary dependency defect: the reported worm compromises npm publication trust and may expose continuous-integration secrets. Practitioners froze the affected publication paths, preserved build evidence and scanne...
- 5
- Findings
- 13
- Experts
- 17
- Messages