Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
August 2, 2026
WhatsApp Zero-Click Gets Forensics, Not Fleet-Wide Handset Panic
A dual-CVE WhatsApp/iOS chain changes the call for executives, journalists and responders, but not for every phone in the fleet. The split is between routine patching and devices that need isolation before sensitive accounts come back.
- 5
- Findings
- 13
- Experts
- 20
- Messages
Reported Rockwell PLC Tampering Outruns Yesterday's Exposure Cleanup
Taking Allen-Bradley PLCs off the internet no longer answered the concern: reports of changed IP addresses and passwords turn this into a control-path integrity problem for water, energy and government sites.
- 5
- Findings
- 13
- Experts
- 21
- Messages
August 1, 2026
Exposed Rockwell PLCs Come Off The Internet After Multi-State Water Disruption Reports
This was not treated as another PLC bug. With FBI/EPA reporting service disruption across multiple states, the call is to cut direct internet paths before operators trust HMI views or remote engineering access.
- 5
- Findings
- 12
- Experts
- 17
- Messages
DeepSeek/Hermes Turns Exposed Tomcat Into A Compromise Hunt
The surprise was not a new species of AI attack; it was speed. Unit 42 says DeepSeek/Hermes chained recon, exploit choice and execution against exposed Tomcat and NetScaler, turning patch tickets into compromise questions.
- 5
- Findings
- 13
- Experts
- 24
- Messages
July 31, 2026
Minnesota Water Utilities Cut Direct PLC And HMI Internet Paths
Disruption across more than 30 communities made this less a patch chase than a control question. Attribution stays caveated; the immediate test is whether operators can narrow PLC/HMI reach without changing controllers blind.
- 4
- Findings
- 12
- Experts
- 21
- Messages
CosmosEscape Gets Forensics First, Not A Fleetwide Key Reset
A cloud database bug can turn key rotation into its own outage. High-value Azure Cosmos DB Gremlin API users need vendor attestation and forensics before controlled rotation, not a tenant-wide fire drill.
- 5
- Findings
- 12
- Experts
- 18
- Messages
July 30, 2026
OWAReaper Puts On-Prem Exchange OWA Ahead Of Chrome AI Tonight
Chrome AI made noise, but the live implant risk sat on on-prem Exchange OWA. Proofpoint’s TA488 report left defenders with the uglier question: whether OWAReaper is already inside the mail front door.
- 5
- Findings
- 12
- Experts
- 21
- Messages
Exposed Cisco FMC Turns Patch Work Into An Assume-Compromise Case
When the firewall manager can rewrite policy, patch status is the weak question. For internet-reachable Cisco FMC, anomalous logins, API use or config exports were enough to start compromise handling.
- 5
- Findings
- 11
- Experts
- 16
- Messages
July 29, 2026
Rockwell Logix Puts Minnesota Water Safety Checks Ahead Of Patching
The Minnesota attacks were already an operations problem; the CISA KEV listing makes them a controller-trust problem. If Logix and the HMI disagree, patch timing is no longer the first question.
- 4
- Findings
- 13
- Experts
- 18
- Messages
Joyfill RAT Turns npm Cleanup Into A Cloud-Secret Rotation Job
A poisoned dependency is not just an app cleanup when it can carry CI/CD tokens into the cloud. StepSecurity-reported Joyfill RAT installs became a build-system breach question, not a package-manager chore.
- 5
- Findings
- 11
- Experts
- 16
- Messages
July 28, 2026
Arista VeloCloud Orchestrator Comes Offline Before Higher-CVSS Bugs
An SD-WAN manager changes who controls the network, not just how exposed an edge box is. With VeloCloud Orchestrator exploitation active, reachable on-prem consoles became outage candidates before the score sheet could settle.
- 5
- Findings
- 11
- Experts
- 16
- Messages
Exposed PLCs Put HMI Readouts On Trial Before Any Engineering Change
If an HMI can be wrong, the patch queue is already late. The call was to treat exposed PLC sites as an operations-integrity problem first: prove the process state from a source the attacker did not touch.
- 5
- Findings
- 11
- Experts
- 18
- Messages
July 27, 2026
Microsoft Device Code Abuse Beats Another Password Reset Today
The danger is not a bad password; it is a valid Entra token earned through a flow users are trained to approve. The call moves past reset-and-MFA comfort toward consent and session controls, where usability starts to bite.
- 5
- Findings
- 12
- Experts
- 19
- Messages
SharePoint Patch Loses To The Web-Shell Hunt On Exposed Servers
The noisy AI botnet did not set the pace; exposed SharePoint did, because a fixed server can still be carrying web shells and live sessions. Treat the patch as the start of the incident.
- 5
- Findings
- 11
- Experts
- 19
- Messages
July 26, 2026
Internet-Facing ServiceNow Comes Offline Before The Patch Today
A pre-auth RCE on a business workflow hub changes the order of operations: if ServiceNow was reachable from the internet, the hard question is who already got in, not whether the update is queued.
- 5
- Findings
- 11
- Experts
- 18
- Messages
Exposed PTC Windchill Outranks BlueHammer For Manufacturers Today
A Windows SYSTEM bug usually wins the morning; not for manufacturers with Windchill on the internet. Reported JSP web shells and Cl0p-linked theft make PTC the system to assume lost first.
- 5
- Findings
- 10
- Experts
- 19
- Messages
July 25, 2026
Hotel Wi-Fi Microsoft 365 Token Theft Beats The Password-Reset Playbook
Travel logins became reusable Microsoft 365 access, not just stolen passwords. The hard part is killing sessions, OAuth grants and app passwords that can survive a clean-looking reset.
- 5
- Findings
- 12
- Experts
- 20
- Messages
July 24, 2026
Splunk Exploitation Turns The Log Server Into The Incident Scene
A breached logging tier can blind the investigation it is meant to support. With CVE-2026-20253 under active exploitation, Splunk was treated as compromise assessment first, patch job second.
- 5
- Findings
- 11
- Experts
- 18
- Messages
Zimbra Patch Run Leaves Sessions Alive Unless Admins Revoke Them
Mail servers do not stop being trusted just because the bug is fixed. With Zimbra CVE-2025-66376 now exploited in the wild, exposed mailbox sessions and admin tokens became part of the incident, not cleanup paperwork.
- 5
- Findings
- 13
- Experts
- 18
- Messages
July 23, 2026
Check Point Management Servers Come Off The Internet Before Cleanup Starts
The firewall console is the blast radius today. SharePoint stayed in cleanup, but exposed Check Point Security Management drew the urgent call because a patched manager may still carry stolen admin access or persistence.
- 5
- Findings
- 12
- Experts
- 21
- Messages