Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
August 22, 2026
Zimbra Advisory Says a Patch Does Not Close an Incident on an Exposed Server
Zimbra’s advisory says internet-facing installations affected by CVE-2026-73570 should be upgraded to 10.1.20 or later and investigated as compromised. The panel put those servers first and rejected treating the upgrade as proof that an exp...
- 5
- Findings
- 11
- Experts
- 15
- Messages
TrueConf Server Isolation Jumps the Queue After Kaspersky's Report
Kaspersky reports that attackers replaced a TrueConf installer, gained SYSTEM privileges, planted a web shell and delivered PhantomCore; CISA’s KEV catalog lists the two underlying flaws. The panel called for affected servers to be isolated...
- 5
- Findings
- 11
- Experts
- 18
- Messages
August 21, 2026
Exposed Siemens S7 Controllers Come Off the Internet Before Anyone Assumes Compromise
U.S. agency reporting supports active targeting of Siemens S7 controllers and capability development against them, but does not confirm that any process has been manipulated. The room put one thing first: take directly exposed S7 controller...
- 3
- Findings
- 12
- Experts
- 17
- Messages
August 20, 2026
SharePoint Patching Is Only Half the Job While Forged Admin Tokens Persist
CISA has added SharePoint CVE-2026-55040 to its Known Exploited Vulnerabilities catalog, and farms exposed during the exploit window may still honour forged administrator tokens after the patch lands. Practitioners refused to call a farm cl...
- 5
- Findings
- 11
- Experts
- 16
- Messages
CISA Confirms Active Siemens S7 Threat; Iran Link Remains Unproven
CISA advisory AA26-231A confirms an active threat to Siemens S7 control environments, where loss of trusted control can put physical processes and safety at risk. The panel prioritised urgent S7 action, while stressing that reported water-u...
- 5
- Findings
- 11
- Experts
- 13
- Messages
August 19, 2026
FBI-Confirmed Water Utility Lockouts Trigger OT Incident Command
The FBI confirmed operator lockouts and configuration changes during cyberattacks affecting water utilities across seven states, putting service continuity and public safety at risk. The panel called for affected utilities to activate OT in...
- 5
- Findings
- 11
- Experts
- 15
- Messages
August 18, 2026
Medusa Advisory Sends Shared Providers Into Timed Recovery Tests
An updated CISA, FBI and HHS advisory says Medusa ransomware has claimed more than 500 victims, with shared service providers concentrating the risk. The panel called for timed containment and recovery exercises rather than treating the upd...
- 6
- Findings
- 12
- Experts
- 16
- Messages
Coinkite Says Affected Coldcard Seeds Require Replacement, Not Patching
Coinkite’s advisory indicates that affected Coldcard seeds must be replaced rather than merely patched, putting funds derived from them at risk. The panel ranked this as today’s most irreversible risk and concluded that holders must generat...
- 5
- Findings
- 12
- Experts
- 15
- Messages
August 17, 2026
Soru: Should we accept the vendor’s claim that AI-assisted triage can replace one Tier-1 SOC analyst this quarter, or keep the current staffing model?
AI-Assisted Triage and Tier-1 SOC Staffing This Quarter
Keep the current staffing model this quarter. The vendor has not demonstrated that AI triage can replace one Tier-1 analyst under your alert mix; reported benchmark weaknesses around silent intrusions reinforce the need for local testing bu...
- 4
- Findings
- 7
- Experts
- 20
- Messages
Allen-Bradley Water Controllers Come Off the Internet; Iran Attribution Waits
Attackers are reported to have manipulated native controls on internet-exposed Allen-Bradley MicroLogix controllers at U.S. water utilities, but the incidents do not verify malware or an Iran-linked campaign. Practitioners put removing that...
- 5
- Findings
- 13
- Experts
- 18
- Messages
Verify Reported CVE-2026-65400 Before Treating Individual Macs as Exposed
A reported Apple vulnerability tracked as CVE-2026-65400 may affect macOS, but the evidence before the panel did not establish exposure on every Mac. Practitioners made verification the gate to patching and investigation, rather than launch...
- 3
- Findings
- 10
- Experts
- 17
- Messages
August 16, 2026
Soru: I am CISO of a multi-sector holding and brief Excom this week. Using CyberRoundtable public daily editions from 9-16 Aug 2026 as the factual week, which develop
Holding CISO Excom brief: strategic cyber week 9-16 Aug 2026
A holding CISO board memo from CyberRoundtable's 9-16 August 2026 daily editions: which in-week developments change posture, capital, disclosure, or cross-company control across a multi-sector portfolio, and what Excom should decide this we...
- 5
- Findings
- 8
- Experts
- 29
- Messages
PTC Windchill Gets Incident Response; Cl0p's 43 Victims Stay Unconfirmed
CISA lists PTC Windchill CVE-2026-12569 in its KEV catalog, and reported JSP web-shell activity supports active exploitation; Cl0p's claim of 43 victims remains unconfirmed. Practitioners nevertheless treated exposed Windchill servers as in...
- 5
- Findings
- 10
- Experts
- 13
- Messages
Manual Control Outranks Attribution in Alleged Texas Chlorine Tampering
The briefing alleges that chlorine settings were manipulated at a Texas water plant and points to Pioneer Kitten, putting treated-water safety at risk; neither the scope nor attribution is independently corroborated. Practitioners still mad...
- 5
- Findings
- 12
- Experts
- 18
- Messages
August 15, 2026
BonkDAO’s Reported $20 Million Loss Puts Quorum Controls Before Code Audit
Source-pack reporting says an attacker exploited BonkDAO’s weak voting quorum to transfer $20 million in BONK, putting treasuries that execute approved proposals automatically at risk. Practitioners treated the loss as governance capture ra...
- 5
- Findings
- 10
- Experts
- 16
- Messages
With No Patch Identified, Exposed GeoServer Comes Off the Internet
WatchTowr and SecurityWeek report attackers targeting a GeoServer zero-day, putting internet-facing mapping servers and connected databases at risk; the briefing identified no available patch. Practitioners judged that exposed instances mus...
- 6
- Findings
- 11
- Experts
- 19
- Messages
August 14, 2026
Public PoC Puts Citrix NetScaler First Without Established In-the-Wild Exploitation
watchTowr published proof-of-concept code for CVE-2026-8452, which can let an unauthenticated attacker run code on SAML-enabled Citrix NetScaler appliances; no in-the-wild exploitation is established. Practitioners nevertheless prioritized...
- 5
- Findings
- 12
- Experts
- 18
- Messages
Reported reverse_ssh Persistence Pushes VMware vCenter Beyond Patching
Exploitation of VMware vCenter CVE-2026-59310 reportedly installed reverse_ssh, giving intruders persistent access to the virtualization management plane. Practitioners judged exposed servers a compromise-response job, not a patch-only task...
- 5
- Findings
- 10
- Experts
- 17
- Messages
August 13, 2026
Reported Akira Intrusion Puts Credential Review Ahead of Encryption Failure
Reporting on an Akira ransomware intrusion describes domain access and data theft through a SonicWall SSL VPN deployment even though the encryption stage failed. The panel refused to read that failure as a defensive win, and asked instead h...
- 7
- Findings
- 11
- Experts
- 19
- Messages
Polish CHP Intrusion Pushes PLC Checks Ahead of Patch Rush
The panel put Polish combined-heat-and-power incident response ahead of the day's patch queue: CERT.PL reporting supports real process disruption, but not customer service loss or attribution of this specific intrusion. Isolate the FortiGat...
- 5
- Findings
- 12
- Experts
- 19
- Messages