Roundtable Archive

Every public Roundtable, on the record.

The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.

Open the Ledger →How it works →RSS: public Roundtable sessions and Decision Records →Podcast RSS: daily edition audio →
Latest on recordOctober 23, 2026
Scheduled · Morning edition
Previously Exposed PHP Systems Come Offline Without Proof They Are Clean
5Findings11Experts18Messages
405
Roundtables convened
4,214
Expert seats taken
Apr–Oct
2026 on record
2
Editions / day
Cadence · Mar → Oct

Last 7 days

What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.

9
Sessions
52
Findings
24
Records published

Threat domains covered · click to filter this week

Filter the archive · applies instantlyNo filters active · showing all editions
Edition
Source
Showing 121–140 of 405 Roundtables
Sort

August 12, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Gunra Ransomware Exploits Fortinet Flaws Against Critical Infrastructure

Gunra ransomware actors are exploiting Fortinet FortiOS and FortiProxy authentication-bypass flaws CVE-2024-55591 and CVE-2025-24472 against critical infrastructure and government organizations, according to a joint U.S.-South Korean adviso...

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +9
5
Findings
13
Experts
18
Messages
ScheduledMorning

Dream Job Targeting, Not DPRK Attribution, Sends Defense Firms Hunting

Check Point says DPRK-linked Operation Dream Job exploited Windows AFD.sys CVE-2026-68820 and Roundcube CVE-2025-49113 in attacks targeting defense, aerospace, and aviation organizations. Practitioners judged that targeting sufficient to tr...

  • Malware
  • Policy
  • AI security
  • Breach response
  • +8
5
Findings
12
Experts
17
Messages

August 11, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

N-able N-central Gets MSP Containment, Not Breach Certainty Today

Reports tie StormEncryptor activity to N-able N-central servers, putting MSP credentials and downstream customer access at risk if the management server is compromised. The panel did not treat the tool details as proven, but still called th...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +6
5
Findings
11
Experts
16
Messages
ScheduledMorning

Gunra's Fortinet Access Forces Same-Day Edge And MSP Hunting

Gunra-linked ransomware reporting put Fortinet firewall access back in the blast path, alongside CISA’s KEV listing for Progress LoadMaster CVE-2026-8037 and activity around SonicWall SMA1000, Check Point VPN, and N-able N-central. The call...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +6
5
Findings
11
Experts
17
Messages

August 10, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Metabase 1.58+ Demands Compromise Response, Not Just A Patch

Attackers are exploiting self-hosted Metabase 1.58+ deployments, putting dashboard sessions, API keys and application-database credentials at risk. The panel treated this as incident response, not routine upgrade work, because Metabase sits...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +6
5
Findings
11
Experts
16
Messages
ScheduledMorning

NetScaler And OWA Jump The Queue As Attackers Target Sessions

Citrix NetScaler CVE-2026-8451 is reported exploited within 24 hours, and vulnerable Outlook Web Access/Exchange paths tied to CVE-2026-42897 put login and session gateways at risk. The panel moved those boxes ahead of Metabase and Langflow...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +10
5
Findings
15
Experts
17
Messages

August 9, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Metabase Zero-Day Beats Water-Control Alarms For Tonight's Work

Metabase faces a CVSS 10.0 unauthenticated SQL injection zero-day exploited to gain admin access, steal credentials, and pull data from connected databases; Framework also disclosed customer-data exposure through Metabase Cloud. Even with w...

  • Policy
  • AI security
  • Breach response
  • Cloud
  • +9
5
Findings
12
Experts
19
Messages
ScheduledMorning

BdThemes Poisoned Feed Jumps Past Yesterday's LoadMaster Alarm

Wordfence reported a poisoned API response in BdThemes' WordPress plugin update path, putting downstream sites at risk if they trusted the feed. Practitioners treated it as a software trust-path failure, not a settled actor story; LoadMaste...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +10
5
Findings
15
Experts
21
Messages

August 8, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

N-able Holds The Lead After Kemp's Fresh Load-Balancer Exploit

A fresh Kemp exploit would normally own the afternoon; here it did not. N-able still carries the harder risk: MSP admin access reportedly used to reach customer systems and leave Cloudflare Tunnel persistence behind.

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +8
5
Findings
13
Experts
20
Messages
ScheduledMorning

N-able N-central Becomes A Customer Compromise Hunt, Not A Hotfix

The MSP console is the trust boundary: exploitation appears to have reached customer networks, so the second mandatory N-central hotfix only starts the work. The question is how far admin access traveled before the fix.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +7
5
Findings
11
Experts
18
Messages

August 7, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Public Water PLCs Come Off The Internet Before Iran Labels Matter

A public PLC/HMI path is a process-safety problem before it is an Iran story. The call was to judge U.S. water systems by what is exposed, not by the label attached to the actor.

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +8
5
Findings
13
Experts
18
Messages
ScheduledMorning

Alleged Coldcard Firmware Flaw Linked to $100M in Estimated Bitcoin Wallet Losses

Older Coldcard firmware allegedly weakened Bitcoin wallet recovery-phrase randomness, putting more than 5,000 wallets at risk and contributing to losses estimated above $100 million. CryptoJS randomness failures also drove at least $5.7 mil...

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +9
5
Findings
13
Experts
18
Messages

August 6, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

AI Agents Lose Privileged Tool Calls Until Humans Approve Them

The patches were not the comfort move; autonomy was. Bedrock AgentCore, Google ADK and Vercel fixes still left the hard question: which agents can touch production without a person in the loop.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +9
5
Findings
13
Experts
19
Messages
ScheduledMorning

Twelve-State Water Utility Attacks Put PLC Recovery Ahead Of Iran Labels

Twelve states turns a familiar PLC story into a continuity call, not an attribution contest. The split was how much weight to put on CyberAv3ngers-style labeling while operators still have controller logic to trust.

  • Policy
  • Supply chain
  • Breach response
  • Cloud
  • +8
5
Findings
12
Experts
18
Messages

August 5, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

SonicWall SMA 1000 Comes Off The Internet Alongside N-Central

INC-linked reporting made SMA 1000 less a patch chore than a place to look for hands already inside. Tomcat and Langflow matter, but exposed admin consoles won the afternoon because they can turn one login into reach.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +8
5
Findings
12
Experts
18
Messages
ScheduledMorning

Cloudflare Tunnels Put N-Central Ahead Of Tomcat's KEV Listing

The fresh KEV bug was Tomcat, but the durable access was in RMM. Huntress-referenced N-central Take Control abuse with Cloudflare Tunnel services made patching only the start of the customer-pivot question.

  • Policy
  • Supply chain
  • AI security
  • Breach response
  • +7
5
Findings
11
Experts
18
Messages

August 4, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Water Utilities Must Pull PLCs From The Internet Before Naming The Actor

The risk is a plant losing safe control, not a cleaner attribution note. Reported multi-state targeting and operational degradation were enough to treat exposed HMI/SCADA/PLC access as a public-safety problem now.

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +9
5
Findings
14
Experts
21
Messages
ScheduledMorning

CyberAv3ngers Target Unitronics PLCs In Water Utilities

CyberAv3ngers is targeting internet-exposed Unitronics Vision PLCs in water and wastewater environments, while CrowdStrike reports attackers are now going directly after AI systems and cloud model access. The highest-priority risks are oper...

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +7
5
Findings
12
Experts
21
Messages

August 3, 2026

2 editions · afternoon + morning
View date →
ScheduledAfternoon

Reported N-Central Exploitation Turns MSP Patch Ticket Into Compromise Case

An RMM bug does not stay inside one tenant. With N-central reportedly exploited, the call shifts from install-the-fix to asking which downstream customer footholds an attacker may already own.

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +7
5
Findings
12
Experts
19
Messages
ScheduledMorning

N-able N-central Outranks Cisco Because MSP Admin Access Fans Out

An exploited N-central console is not just another exposed appliance; it can become a route into customers that trusted the MSP. Cisco stayed in view, but without a fresh scope change, N-central set the morning’s work.

  • Malware
  • Policy
  • Supply chain
  • AI security
  • +7
5
Findings
12
Experts
18
Messages

Unified Search

Search the public record.