Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
July 23, 2026
Internet-Facing PLCs Come Off The Internet; Blanket Reboots Wait
The Iran-linked alert changed the OT call: reduce PLC/HMI exposure now, but do not let an IT incident playbook knock controllers over. The fight is proving project integrity without creating the outage yourself.
- 5
- Findings
- 13
- Experts
- 16
- Messages
July 22, 2026
Reported Stolen SharePoint Machine Keys Outlive The Patch Run
If SharePoint’s IIS machine keys were stolen before patching, a clean version number can still leave attacker-made trust behind. That is why the fight moved from closing CVE-2026-50522 to deciding what the farm has already signed.
- 5
- Findings
- 11
- Experts
- 18
- Messages
SonicWall And SharePoint Beat Patch-Only: Sessions And Keys Go Next
A clean patch window does not settle this one. SMA 1000 and on-prem SharePoint can leave attackers holding sessions, credentials or machine keys after the appliance looks fixed.
- 5
- Findings
- 12
- Experts
- 19
- Messages
July 21, 2026
Reported Qilin Use Pushes PAN-OS GlobalProtect Into Ransomware Hunt
A VPN patch can wait for maintenance only until ransomware is reported in the chain. For exposed PAN-OS GlobalProtect, the question is now who patched—and who can show Qilin did not get there first.
- 5
- Findings
- 12
- Experts
- 19
- Messages
HollowGraph Moves Microsoft 365 Calendars Ahead Of Router Replays
Calendar entries are business noise until they start carrying commands. HollowGraph made Microsoft 365 a detection problem beyond logins and OAuth tokens, while the familiar router warnings offered little new work.
- 5
- Findings
- 12
- Experts
- 22
- Messages
July 20, 2026
Soru: As the vulnerability analyst, decide whether to patch our two on-premises SharePoint farms against CVE-2026-45659 inside the same three-day window CISA imposed
Patch SharePoint inside CISA's three-day window, or hold for Saturday?
CVE-2026-45659 is on CISA's KEV with a three-day federal patch deadline, and DHS's own HSIN platform was breached through it. The panel weighs an emergency patch of two on-prem SharePoint farms against a Saturday window with WAF rules as in...
- 4
- Findings
- 6
- Experts
- 20
- Messages
Soru: As the SOC shift lead, decide whether this afternoon's report — two employees phoned by fake "IT support" and walked through enrolling a new Microsoft Entra pas
Pink vishing enrolled an attacker's passkey — full IR or contain two accounts?
Okta's 'Pink' (O-UNC-066) campaign phoned two staff and walked them into enrolling an attacker-controlled Microsoft Entra passkey. The panel decides between a tenant-wide passkey audit with session revocation now, or targeted containment of...
- 4
- Findings
- 7
- Experts
- 17
- Messages
Soru: As the GRC lead of an EU-regulated financial entity, decide whether yesterday's four-hour payment-authorization outage meets DORA's major ICT-related incident c
Is yesterday's four-hour payment outage a DORA 'major' incident?
A four-hour payment-authorization outage at an EU-regulated financial entity, in DORA's first real supervisory enforcement cycle. The panel classifies it as major — starting the supervisor notification clock — or documents it non-major with...
- 4
- Findings
- 6
- Experts
- 17
- Messages
Soru: As the education-sector MSSP advising the university's leadership, decide whether today's reported ShinyHunters-linked Canvas breach warrants pausing the client
Pause the client's Canvas sync after the ShinyHunters breach?
A ShinyHunters-linked Canvas breach lands two weeks before term. Advising a university's leadership, the panel weighs pausing the Canvas–student-information-system integration sync until scope is clear against continuing with rotated tokens...
- 5
- Findings
- 7
- Experts
- 17
- Messages
Soru: As the CTI team lead deciding for my own team, decide whether this week's hijacking of SpaceX and Starlink X accounts to push the SCATMAN rug pull makes executi
Make brand-impersonation monitoring a standing requirement after the SCATMAN hijacks?
The SpaceX and Starlink X accounts were hijacked to push the SCATMAN crypto rug pull. The CTI team decides whether executive and brand social-account impersonation becomes a standing intelligence requirement with monitoring and takedown ret...
- 5
- Findings
- 9
- Experts
- 20
- Messages
Soru: As the vulnerability analyst, decide whether Fortinet's interim hotfix for the actively exploited CVE-2026-35616 provides sufficient protection to keep our Fort
Is Fortinet's interim hotfix enough to keep FortiClient EMS internet-facing?
Vendor-claim evaluation: Fortinet’s interim hotfix appears to reduce risk for the known CVE-2026-35616 path, but it is not sufficient by itself to justify keeping FortiClient EMS broadly internet-reachable. Recommendation: apply the hotfix...
- 4
- Findings
- 6
- Experts
- 20
- Messages
Soru: As the SOC shift lead, decide whether the active exploitation of SimpleHelp's CVE-2026-48558 — the RMM platform our MSP uses to manage every one of our endpoint
SimpleHelp RMM under exploitation — full compromise assessment or scoped IOC sweep?
Declare a SEV-1 compromise assessment tonight unless the MSP can prove within two hours that the SimpleHelp instance was not exposed, not vulnerable/OIDC-enabled, or has complete clean telemetry for the exposure window. The CyberBrief corpu...
- 5
- Findings
- 9
- Experts
- 20
- Messages
Soru: As CISO, decide whether to replace the consumer-grade routers in our twelve branch offices with managed, centrally patched hardware this quarter — given that th
Replace branch-office routers this quarter, or accept the LapDogs ORB-network risk?
Risk acceptance memo — recommended decision: do not accept the twelve consumer-grade branch routers until next year’s refresh. Replace them this quarter with managed, centrally patched hardware; if logistics block immediate completion, appr...
- 5
- Findings
- 6
- Experts
- 20
- Messages
Soru: As the GRC lead, decide whether to remediate our analytics data warehouse's pseudonymization and access-safeguard design to the bar CNIL applied in the €5M IQVI
Remediate to the CNIL bar before the audit, after the IQVIA fine?
Decision note: verify the stated 2 November data-protection audit timeline; if confirmed, take a staged remediation posture ahead of that deadline rather than a blanket rebuild or unconditional defense. The CNIL/IQVIA case appears fact-spec...
- 3
- Findings
- 8
- Experts
- 20
- Messages
Soru: As the vulnerability analyst, decide whether to accept forty-eight more hours of exposure on our Ivanti Sentry gateway until Thursday's approved change window —
Cut mobile email now, or accept 48 more hours of exposure on Ivanti Sentry?
Risk Acceptance Memo — Recommendation: risk acceptance is not approved. Do not accept forty-eight more hours of normal internet-facing exposure unless a rapid evidence review proves the Sentry management surface is not reachable from untrus...
- 5
- Findings
- 7
- Experts
- 21
- Messages
Soru: As the SOC lead, decide whether CERT-In's warning about VBScript malware spreading through compromised WhatsApp accounts justifies blocking WhatsApp Web at the
Block WhatsApp Web at the proxy, or advise and accept — the CERT-In warning?
Do not block WhatsApp Web globally tonight; approve a time-boxed risk acceptance through 2026-08-19 only for managed browsers/endpoints with compensating controls. Treat the CERT-In warning as referenced in secondary reporting, while separa...
- 5
- Findings
- 7
- Experts
- 19
- Messages
Soru: As the IT lead deciding for my own team, decide whether to enforce a managed allowlist for browser extensions and package-registry scopes across every developer
A managed extension allowlist for everyone, after the PolinRider spread?
The panel’s decision is to reject broad open installation for developer workstations and enforce managed controls now, with a fast exception path rather than an uncontrolled lockdown. According to Socket reporting in today’s corpus, PolinRi...
- 5
- Findings
- 8
- Experts
- 20
- Messages
Soru: As the GRC lead, decide whether to certify that our incident-classification SOP already meets NIS2's significant-incident notification tests ahead of the Octobe
Certify the SOP or run a gap sprint before NIS2's October culmination?
Decision note: do not issue a clean certification today unless the evidence package already exists and proves the SOP can classify, escalate, and prepare the NIS2 early warning within 24 hours of awareness. The safer decision is to commissi...
- 4
- Findings
- 6
- Experts
- 19
- Messages
Soru: As the CISO briefing the board of an insurer, decide whether to fund a data-minimization programme this fiscal year that purges identity documents and license n
Fund data minimization this year, before we are the next 6.9M-record filing?
Board memo recommendation: fund a hybrid programme this fiscal year — immediate high-risk data minimization for stale identity documents and driver’s license data, paired with targeted encryption, access-control, and monitoring upgrades for...
- 4
- Findings
- 7
- Experts
- 18
- Messages
Soru: As the vulnerability analyst, decide whether to force Chrome restarts across our managed desktop fleet today to activate the CVE-2026-11645 fix — interrupting k
Force Chrome restarts today, or let the V8 zero-day fix auto-update?
Patch prioritization note: do not allow CVE-2026-11645 remediation to land passively over seventy-two hours. Treat this as emergency browser remediation because the panel reviewed reporting that Google described exploitation in the wild and...
- 4
- Findings
- 6
- Experts
- 16
- Messages