Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
July 20, 2026
Soru: As the SOC shift lead, decide whether to hunt for JSP webshells across our Cisco Unified CM voice stack before patching CVE-2026-20230 — preserving forensic evi
Hunt webshells first or patch first — the Cisco Unified CM flaw?
Decision: do not choose “hunt indefinitely before patching.” Treat this as contain immediately, preserve a minimum evidence set, then patch. Per the briefing and CyberBrief corpus, CVE-2026-20230 exploitation has been reported against Cisco...
- 5
- Findings
- 7
- Experts
- 20
- Messages
Soru: As the security analyst, decide whether to audit and re-delegate all sixty of our registered domains this sprint — closing the lame-delegation gaps the Sitting
Re-delegate sixty domains this sprint, or wait for quarterly hygiene — Sitting Ducks?
Risk acceptance decision: do not accept unaudited lame-delegation exposure until the quarterly DNS hygiene review. Audit all 60 registered domains this sprint; allow only domain-specific, evidence-backed deferrals for domains proven to be n...
- 3
- Findings
- 6
- Experts
- 20
- Messages
Soru: As the engineering lead deciding for my own team, decide whether to keep our AI coding agent authorized to open and auto-merge routine dependency-update pull re
Let the coding agent auto-merge, or gate every PR — after the Copilot jailbreak?
Risk acceptance memo: approve a 30-day conditional exception, not blanket AI-agent auto-merge. Turn off auto-merge for every model-authored PR; allow only mechanically bounded dependency updates where a separate merge identity acts after po...
- 5
- Findings
- 9
- Experts
- 20
- Messages
Soru: As the MSSP advising client leadership, decide whether to invoke emergency change windows across all fourteen managed clients running on-premises SharePoint — m
Emergency change windows for fourteen clients — the SharePoint precedent?
Decision: do not frame this as “all fourteen immediately” versus “only the six internet-facing.” Because CVE-2026-45659 is listed in CISA KEV for active exploitation and Microsoft/MSRC guidance describes a SharePoint Server RCE requiring au...
- 5
- Findings
- 8
- Experts
- 19
- Messages
Soru: As the SOC lead, decide whether the MemGhost technique — planting persistent poisoned instructions in an AI agent's memory through a single crafted email — requ
Suspend the email-triage AI agent, or filter and continue — the MemGhost prompt-injection?
MemGhost is a credible AI-memory integrity risk, not confirmed active exploitation. Recommendation: conditional continuation, not full suspension — the SOC email-triage pilot may run for 30 days only in degraded/read-only-memory mode while...
- 3
- Findings
- 7
- Experts
- 21
- Messages
Soru: As CISO, decide whether to issue hardened travel-only devices to our executive team for upcoming EU and Middle East trips — after Citizen Lab confirmed that a m
Hardened travel devices or Lockdown Mode — the Pegasus finding?
The panel’s decision is not to accept blanket residual risk for executive primary devices on EU and Middle East travel. For the next 90 days, primary-device use is acceptable only for lower-risk travel with verified hardening, Lockdown Mode...
- 4
- Findings
- 7
- Experts
- 21
- Messages
Soru: As the CTI lead of a digital-asset platform deciding for my own team, decide whether TRM's finding that North Korea-linked groups took roughly $643 million — tw
Build DPRK tracking in-house, or trust the tracing vendor — the $643M share?
TRM’s reported H1 2026 figure — about $643M in North Korea-linked crypto theft out of roughly $972M total losses — is strong enough to justify a DPRK-focused validation capability, but not a full in-house replacement for a blockchain tracin...
- 5
- Findings
- 8
- Experts
- 22
- Messages
Soru: As the SOC shift lead, decide whether the in-the-wild exploitation of CVE-2026-20896 in the official Gitea Docker image — the same image running our internet-re
Offline rebuild tonight or VPN-restrict — the published Gitea/Docker auth bypass?
SOC decision: do not keep this Gitea CI server operating normally behind VPN while you “look around.” Based on the briefing and panel review, CVE-2026-20896 is reported as an auth-bypass issue in affected official Gitea Docker deployments w...
- 5
- Findings
- 8
- Experts
- 19
- Messages
Soru: As the DevOps lead deciding for my own team, decide whether to prioritize pinning every GitHub Action to a commit SHA and migrating CI to OIDC-scoped short-live
Pin every GitHub Action to a SHA this sprint — the TeamPCP harvest?
Patch prioritization decision: use a risk-based hybrid, not an all-repo freeze and not a quarter-long deferral. Pause Tier-0 release, deploy, signing, package-publishing, and production cloud workflows for up to seven days unless complete l...
- 4
- Findings
- 8
- Experts
- 18
- Messages
Soru: As the vulnerability analyst, re-evaluate last week's decision to emergency-patch our NetScaler Gateways against CVE-2026-8451 in light of the exploitation and
Does last week's NetScaler patch call still stand — re-evaluating the CitrixBleed-again decision?
Last week’s emergency patch decision for NetScaler Gateway CVE-2026-8451 still holds. The panel found credible reporting of exploitation attempts, but the DragonForce linkage for this specific CVE remains low-confidence and should not drive...
- 4
- Findings
- 7
- Experts
- 17
- Messages
Soru: As the CISO briefing the board of an energy operator, decide whether to pull the OT network-segmentation capital programme approved for 2027 forward into the se
Pull the OT segmentation capex forward — Armored Likho and the FSB advisories?
Board memo recommendation: do not pull the entire 2027 OT segmentation programme into H2 2026; approve a targeted H2 2026 acceleration of OT boundary segmentation, OT DMZ/remote-access control, network-device management-plane isolation, and...
- 5
- Findings
- 8
- Experts
- 25
- Messages
Soru: As CISO, decide whether JADEPUFFER — the first documented ransomware intrusion run end-to-end by an autonomous LLM agent — invalidates the human-speed assumptio
Re-baseline SLAs for machine-speed intrusions — the JADEPUFFER wargame?
Risk acceptance memo — do not accept a 90-day wait on containment automation as-is; fund targeted automated containment this quarter for JADEPUFFER-class paths that are relevant and internally verified, while deferring broad fleet-wide auto...
- 4
- Findings
- 7
- Experts
- 28
- Messages
Soru: As the CTI analyst, decide whether to keep submitting TLP:AMBER indicators and victim context through government information-sharing platforms after DHS's own H
Keep sharing through government platforms, after the HSIN breach?
Risk acceptance memo: For the next 30 days, adopt a controlled-sharing posture rather than normal full-context submission through government information-sharing platforms. Continue sending sanitized, machine-actionable indicators and defens...
- 5
- Findings
- 7
- Experts
- 21
- Messages
Soru: As the GRC lead of a university running Oracle PeopleSoft Campus Solutions, decide whether ShinyHunters' active exploitation of CVE-2026-35273 and the 455,000-r
Pre-notify the regulator or assess first — the PeopleSoft zero-day fallout?
Apply emergency compensating controls now, but do not file a formal data-protection breach notification unless local evidence shows unauthorised access to personal data or critical logging gaps make such access reasonably likely. Treat this...
- 4
- Findings
- 6
- Experts
- 23
- Messages
Soru: As CISO, decide whether to revoke every GitHub token exposed to the Hades PyPI campaign immediately — accepting the campaign's explicit "gh-token-monitor" threa
Revoke the PyPI tokens now despite the retaliation threat — the Hades extortion?
Recommended CISO decision: do not perform blind global GitHub token revocation as the first click. Revocation and rotation are mandatory tonight, but the panel recommends a controlled 30–45 minute containment sprint first because researcher...
- 5
- Findings
- 8
- Experts
- 24
- Messages
Soru: As the CISO briefing the board, decide whether to move board and executive communications to a company-managed end-to-end-encrypted channel with governed retent
Move executive comms to E2EE — after Salt Typhoon reached the wiretaps?
Board memo: approve a 90-day controlled migration of board and executive sensitive communications to a company-managed, enterprise E2EE channel with governed retention. Do not approve consumer messaging or unmanaged encrypted apps as the co...
- 4
- Findings
- 7
- Experts
- 21
- Messages
Soru: As CISO, decide whether to re-enable Microsoft 365 Copilot Enterprise Search for the executive team on the strength of Microsoft's server-side fix for the Searc
Re-enable Copilot for the exec team — after the SearchLeak finding?
Verdict: do not re-enable Microsoft 365 Copilot Enterprise Search for the executive team on Microsoft’s server-side fix alone. Treat Microsoft’s fix as closure of the reported product chain, not proof that executive tenant data, permissions...
- 4
- Findings
- 8
- Experts
- 29
- Messages
Reported ServiceNow Exploits Push Exposed Instances Past Patch-Only
A workflow system can sit near approvals, credentials and payments, so CVE-2026-6875 does not close on patch status alone. The evidence is still reporting-led; the question is whether your instance shows it was touched.
- 5
- Findings
- 12
- Experts
- 21
- Messages
SonicWall SMA 1000 Jumps SharePoint On Credential Theft Reports
An internet-facing VPN box can hand attackers sessions, not just a CVE score. With SharePoint offering no fresh defender change, exposed SMA 1000 appliances drew the harder call: preserve evidence before calling the patch done.
- 5
- Findings
- 12
- Experts
- 20
- Messages
July 19, 2026
Soru: As the CTI analyst, decide whether our customer-facing advisory on the PolinRider campaign states North Korean attribution at high confidence, medium confidence
How confidently do we state North Korean attribution in the PolinRider advisory?
We should not publish “high-confidence North Korean attribution” for PolinRider in our own advisory voice. The defensible decision is to use primary activity-cluster language: confirmed malicious developer/supply-chain credential-theft acti...
- 5
- Findings
- 8
- Experts
- 23
- Messages