Cyber Decision LedgerPublic reviewed decisions

The decisions, on the record.

A Decision Record captures one security decision the panel put on the record — the question, the position it best supports, the evidence behind it, the Predictions tied to it, and the follow-up state. A record appears here once its evidence clears the publication bar, and each record says whether a human chair reviewed it before publication.

Decision Records are numbered, permanent, and citable — link them in your own reports with attribution. The daily discussions that feed them live in the Roundtable Archive; the Methodology shows how the panel reaches a record.

Filter this page · applies instantlyNo filters active · showing all records30 shown
Sort

Decision Records

16 JULY 20263 records
RecordCRT-2026-00862026.07.16Afternoon roundtable
Emergency containment for exposed SonicWall, Ivanti, Cisco IOS, and ColdFusion systems

Contain exposed perimeter and application systems before routine patching

Exposed SonicWall SMA1000 and Ivanti Sentry systems should be restricted or isolated first, with logs and configurations preserved, rapid vendor-guided remediation, and appliance-held secrets revoked; Cisco IOS and ColdFusion systems should be hunted for exposure and isolated if compromise indicators appear.

AreaPatch prioritizationSOC escalationTechNetwork security
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps9 references
StateActiveRev 2026-07-16
RecordCRT-2026-00852026.07.16Afternoon roundtable
OT/critical-infrastructure exposure triage and patch sequencing

Triage OT edge and ICS advisories without blind patching

Pull engineering into triage for exposed router and edge paths and packet-flagged ICS/OT advisories. First isolate exposure, restrict management access, confirm backups and configuration exports, add segmentation and monitoring, then patch during approved outages unless active exploitation or unsafe exposure is confirmed.

AreaPatch prioritizationVulnerabilityTechICS / OT
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-16
RecordCRT-2026-00842026.07.16Afternoon roundtable
Exposure-based patch prioritization and compromise validation

Prioritize exposed enterprise systems over bulk patching

Prioritize exposed SharePoint Server, SonicWall SMA1000, and vulnerable Joomla deployments for patching or isolation within 24 hours; preserve logs and hunt for web shells, authentication-bypass activity, appliance abuse, and post-exploitation before declaring systems clean. Stage the broader Microsoft patch wave by exposure and business criticality.

AreaPatch prioritizationVulnerability
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps8 references
StateActiveRev 2026-07-16Prediction · due 15 AugNext checkpoint 15 Aug
14 JULY 20268 records
RecordCRT-2026-00832026.07.14Afternoon roundtable
AI platform and agent exposure triage

Prioritize AI platform risks by exposure to secrets, execution, and automation

Inventory and block public access to MCP, local LLM, JSON-RPC, assistant configuration, and .env paths; validate vendor applicability before patching or isolating affected AI platform deployments; audit Langflow and similar tools for AWS metadata, secrets, CI/CD, and internal API access; rotate keys only if suspicious access appears.

AreaPatch prioritizationRisk acceptanceTechCloud platform
SeverityMedium
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-14
RecordCRT-2026-00822026.07.14Afternoon roundtable
Delegated-trust incident response

Revoke delegated trust before relying on password resets

Revoke active sessions, refresh tokens, OAuth grants, device-code sessions, suspicious enterprise applications, connected-app access, and exposed cloud keys before relying on password resets; then re-consent under tighter controls and reissue scoped credentials.

AreaPatch prioritizationRisk acceptanceTechIdentity & access
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps8 references
StateActiveRev 2026-07-14
RecordCRT-2026-00812026.07.14Afternoon roundtable
ShareFile Storage Zone Controller shutdown and isolation

Isolate applicable self-managed ShareFile Storage Zone Controllers

Isolate or power down applicable self-managed/on-prem ShareFile Storage Zone Controllers, preserve logs and configuration, and restore only after applicable vendor mitigation is validated or a clean rebuild is completed.

AreaRisk acceptanceVulnerabilityTechSaaS collaboration
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-14Prediction · due 13 AugNext checkpoint 13 Aug
RecordCRT-2026-00802026.07.14Morning roundtable
AI developer infrastructure hardening

Harden and hunt exposed AI developer endpoints

Inventory MCP, Ollama, and OpenAI-compatible endpoints; bind them to localhost, VPN, or private networks; require auth or mTLS; remove secrets from assistant config files; block agent/tool runtimes from reaching cloud metadata services unless explicitly needed; and hunt external probes and metadata calls from agent hosts.

AreaPatch prioritizationVulnerabilityTechAI / ML systems
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-07-14
RecordCRT-2026-00792026.07.14Morning roundtable
CMS webshell exposure handling

Split CMS webshell incidents from exposure-only cases

Use an evidence-based split: isolate confirmed compromised CMS hosts with webshell evidence, preserve evidence, rotate related credentials, and rebuild from clean media; if there is only matching exposure without shell evidence, patch and hunt, remove public admin paths, and add WAF/CDN controls.

AreaCampaignPatch prioritizationTechWeb application
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-14
RecordCRT-2026-00782026.07.14Morning roundtable
Identity, SaaS, and cloud recovery

Revoke delegated identity trust before credential rotation

Treat OAuth grants, sessions, refresh tokens, connected-app tokens, exposed cloud principals, STS sessions, service-account delegation, and guest access as attacker-held trust state; revoke or freeze them before relying on password or key rotation, then re-consent only approved apps and hunt SaaS-to-SaaS access.

AreaRisk acceptanceTechIdentity & access
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps7 references
StateActiveRev 2026-07-14
RecordCRT-2026-00772026.07.14Morning roundtable
PAN-OS GlobalProtect and portal patch prioritization

Emergency-triage exposed PAN-OS portal deployments

Review exposed PAN-OS GlobalProtect and Captive/User-ID Portal deployments today; restrict or disable exposed portals where appropriate, patch or mitigate per confirmed vendor guidance, and hunt for unauthorized VPN sessions, firewall changes, credential theft, lateral movement, suspicious management logins, and configuration changes.

AreaPatch prioritizationSOC escalationVulnerabilityTechNetwork security
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps7 references
StateActiveRev 2026-07-14
RecordCRT-2026-00762026.07.14Morning roundtable
Progress ShareFile Storage Zone Controller containment

Isolate affected Progress ShareFile Storage Zone Controllers

Treat affected on-prem Progress ShareFile Storage Zone Controllers as an immediate containment decision where Progress guidance applies: restrict exposure, isolate or power off affected controllers if safe containment is not available, preserve logs and forensic data, and rebuild or restore only after validated guidance.

AreaPatch prioritizationRisk acceptance
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-14Prediction · due 28 JulNext checkpoint 28 Jul
13 JULY 20265 records
RecordCRT-2026-00752026.07.13Afternoon roundtable
Identity and SaaS incident response

Treat suspected AiTM and SaaS abuse as session and OAuth trust compromise

For suspected Microsoft 365 AiTM, Salesforce, OAuth, or help-desk social-engineering exposure, handle the event as potential attacker-held session, refresh-token, or connected-app trust rather than password-only compromise. Revoke sessions, invalidate refresh tokens, review OAuth and connected apps, inspect risky sign-ins, Salesforce exports and API volume, review new MFA enrollments or reset events, verify high-risk help-desk resets through pre-registered channels, and enforce phishing-resistant authentication for admin and high-risk roles.

AreaBreachSOC escalationTechSaaS collaboration
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-13
RecordCRT-2026-00742026.07.13Afternoon roundtable
Supply-chain incident response

Scope secret rotation and artifact rebuilds to executed supply-chain code

Rotate or revoke secrets and rebuild artifacts only where malicious code executed in a trusted developer, CI, build, release, or privileged browser context with access to secrets or artifacts. Elsewhere, remove and block affected artifacts, pin or block bad versions, disable untrusted lifecycle scripts where feasible, block ModHeader until a clean build is validated, and avoid a blanket engineering freeze for unaffected environments.

AreaPatch prioritizationSupply chain
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps9 references
StateActiveRev 2026-07-13
RecordCRT-2026-00732026.07.13Morning roundtable
D-Link DIR-513 isolation and replacement

Hard-isolate exposed D-Link DIR-513 v1.10 devices

Promptly retire or hard-isolate D-Link DIR-513 v1.10 devices that are exposed or show exploit attempts, remove WAN exposure, restrict management to allowlisted networks, block external access to /goform/formDeviceReboot, enable applicable IPS protection, and verify replacement or firmware options through authoritative sources.

AreaPatch prioritizationTechNetwork infrastructure
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-13
RecordCRT-2026-00722026.07.13Morning roundtable
Developer supply-chain containment

Use scoped containment for developer supply-chain exposure

Scope exposure to affected jscrambler, ModHeader, and poisoned Go-module paths; rotate reachable developer, CI/CD, cloud, signing, registry, browser, and AI-tool secrets where malicious code executed; quarantine affected build paths; pin known-good versions identified by local inventory; rebuild artifacts from clean runners; and add provenance checks.

AreaPatch prioritizationTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps7 references
StateActiveRev 2026-07-13
RecordCRT-2026-00712026.07.13Morning roundtable
Managed Android Chrome and WebView patching

Force managed Android Chrome updates without full-device RCE claims

Force managed Chrome for Android 150.0.7871.47 or later where applicable, assess managed WebView exposure, enforce EMM compliance and conditional access for high-risk users, and brief the issue as urgent browser/WebView exposure rather than confirmed Android RCE, sandbox escape, or full-device takeover.

AreaPatch prioritizationVulnerabilityTechMobile platform
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps7 references
StateActiveRev 2026-07-13
12 JULY 20266 records
RecordCRT-2026-00702026.07.12Afternoon roundtable
Rust libp2p gossipsub patch prioritization

Patch Rust libp2p gossipsub separately from Bonzo

For operators that validate affected Rust libp2p gossipsub exposure, prioritize prompt patching for CVE-2026-34219 and keep that CVE separate from the Bonzo Lend oracle-exploit response.

AreaPatch prioritization
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-07-12
RecordCRT-2026-00692026.07.12Afternoon roundtable
MFA phishing session and token response

Handle MFA phishing as session and token compromise

For Evilginx-style AiTM or Microsoft device-code phishing exposure, start with trust-state destruction: revoke sessions and refresh tokens, review OAuth grants and enterprise app consent, restrict or disable device-code flow where feasible, hunt for token replay, and prioritize phishing-resistant authentication for sensitive users.

AreaRisk acceptanceVulnerabilityTechIdentity & access
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-12
RecordCRT-2026-00682026.07.12Morning roundtable
Canonical/Ubuntu disruption and supply-chain escalation posture

Treat Canonical/Ubuntu hacktivist claims as availability triage absent supply-chain evidence

Treat the Canonical/Ubuntu pro-Iran hacktivist claim as geopolitical disruption context and availability-risk triage, not as assumed Iranian state tasking or Ubuntu supply-chain compromise, unless authoritative evidence shows deeper impact.

AreaCampaignPatch prioritizationSupply chain
SeverityMedium
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-07-12
RecordCRT-2026-00672026.07.12Morning roundtable
GitHub audit visibility and source-control access response

Escalate GitHub ghost-account API reconnaissance to source-control response

Enable and stream GitHub api.request audit events, hunt dormant-account enumeration and unusual user agents, correlate enumeration with private-repository cloning or access anomalies, revoke abnormal PAT/OAuth tokens, expire stale PATs, review OAuth grants, and remove dormant external collaborators.

AreaSOC escalationTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-12
RecordCRT-2026-00662026.07.12Morning roundtable
Microsoft 365 and Entra identity controls

Lock down Entra passkey and device-code abuse paths

Restrict passkey/FIDO2 registration by group and trusted context, block or tightly scope device-code flow, alert on authentication-method changes, remove suspicious enrolled methods, and revoke sessions or refresh tokens where abuse is suspected.

AreaPatch prioritizationVulnerabilityTechIdentity & access
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps8 references
StateActiveRev 2026-07-12
RecordCRT-2026-00652026.07.12Morning roundtable
Internet-facing CMS containment and patch triage

Treat exposed CMS compromise indicators as containment work

Inventory and triage internet-facing CMS exposure now; patch vulnerable or unknown-state platforms and plugins, hunt for webshells and abnormal web-server child processes, and isolate or rebuild hosts when compromise indicators are present.

AreaPatch prioritizationSOC escalationVulnerabilityTechWeb application
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-12Prediction · due 11 AugNext checkpoint 11 Aug
11 JULY 20268 records
RecordCRT-2026-00642026.07.11Afternoon roundtable
Managed mobile remote-access controls

Disallow unmanaged Android VPN apps for enterprise access

Do not allow unmanaged or free Android VPN apps as enterprise access compensating controls. Enforce managed VPN or managed ZTNA only for corporate access, block unapproved VPN packages in managed Android profiles, deny mail/SSO/SaaS tokens from devices running unknown VPN clients where controls can see them, and require vendor review for plaintext config delivery, DNS/IPv6 leakage, encryption practices, and tracking SDKs.

AreaPatch prioritizationRisk acceptanceTechMobile platform
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-11
RecordCRT-2026-00632026.07.11Afternoon roundtable
Supply-chain and crypto custody containment

Quarantine affected Injective developer and crypto trust paths

Quarantine builds or applications using affected Injective-related packages, block confirmed risky package/version ranges at artifact proxies, rebuild from clean dependencies, rotate npm/GitHub publishing and reachable development credentials, and treat wallet or treasury material generated or imported through confirmed affected SDK paths as exposed by migrating to fresh signers.

AreaPatch prioritizationSupply chainTechDevOps supply chain
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-11
RecordCRT-2026-00622026.07.11Afternoon roundtable
Gitea Docker containment and hunting

Contain unverified internet-facing Gitea Docker deployments pending proxy-auth verification

For internet-facing official Gitea Docker deployments in the packet-described vulnerable set or with unknown reverse-proxy-auth or trusted-proxy configuration, block direct public access, allow only known reverse-proxy or VPN sources, preserve logs, upgrade after staging, and hunt for X-WEBAUTH-USER impersonation, repo changes, token creation, webhook changes, and CI/CD credential abuse.

AreaPatch prioritizationSOC escalationThreat actorTechDevOps supply chain
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-11
RecordCRT-2026-00612026.07.11Afternoon roundtable
Containment before patch-only remediation

Isolate exposed ShareFile, Langflow, and NetScaler systems before patch-only remediation

Isolate or remove direct internet reach where exposure is plausible; preserve logs and configurations, patch from vendor advisories, revoke or rotate affected trust state and secrets, hunt for persistence, webshells, token theft, and suspicious admin activity, and restore only after blast radius is understood.

AreaPatch prioritizationTechNetwork security
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps8 references
StateActiveRev 2026-07-11
RecordCRT-2026-00602026.07.11Morning roundtable
Incident briefing and delegated-trust framing

Brief incidents as separate lanes with a delegated-trust pattern

Do not brief the day’s incidents as one grand control-plane campaign. Track a narrower delegated-trust abuse pattern across identity, workflows, packages, agents, and cloud services while keeping CMS webshelling, weak wallet randomness, and conventional exploitation in separate operational lanes.

AreaCampaignThreat actor
SeverityMedium
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-07-11
RecordCRT-2026-00592026.07.11Morning roundtable
Privileged AI coding agent controls

Sandbox privileged AI coding agents and MCP-connected tools

Disable or sandbox privileged AI coding agents and MCP-connected tools that can execute shell commands, write outside workspaces, auto-approve tools, reach networks, reuse browser sessions, access credentials, install packages, push or merge code, invoke cloud administration, or access secrets-bearing CI/CD contexts; restore only with sandboxes, ephemeral credentials, explicit high-risk approvals, and prompt-to-tool logging.

AreaRisk acceptanceTechAI / ML systemsDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-11
RecordCRT-2026-00582026.07.11Morning roundtable
Ransomware driver abuse and destructive recovery response

Prioritize ransomware driver abuse and wiper behavior before encryption

Move driver-control and destructive-attack branching earlier in ransomware response through driver allow-listing, vulnerable or malicious driver block rules, alerts on unexpected kernel driver loads followed by EDR health loss, rapid isolation, immutable-backup validation, and rebuild planning.

AreaPatch prioritizationVulnerability
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-11
RecordCRT-2026-00572026.07.11Morning roundtable
Injective npm SDK compromise response

Treat compromised Injective npm SDK exposure as key compromise

Stop using affected Injective npm SDK builds, move to verified clean releases, rotate related API and build secrets, and migrate funds to fresh wallets generated on clean machines when mnemonic or private-key exposure is possible.

AreaSupply chainVulnerabilityTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-07-11

Showing 30 records · page 12 of 14

These controls filter only the 30 records on this page. Search the full Ledger →

Unified Search

Search the public record.