Cyber Decision LedgerPublic reviewed decisions

The decisions, on the record.

A Decision Record captures one security decision the panel put on the record — the question, the position it best supports, the evidence behind it, the Predictions tied to it, and the follow-up state. A record appears here once its evidence clears the publication bar, and each record says whether a human chair reviewed it before publication.

Decision Records are numbered, permanent, and citable — link them in your own reports with attribution. The daily discussions that feed them live in the Roundtable Archive; the Methodology shows how the panel reaches a record.

Filter this page · applies instantlyNo filters active · showing all records30 shown
Sort

Decision Records

11 JULY 20262 records
RecordCRT-2026-00562026.07.11Morning roundtable
Microsoft 365 and Entra compromise response

Revoke durable trust artifacts after M365 or Entra compromise

For affected Microsoft 365 or Entra tenants and users, reset credentials and also revoke sessions and refresh tokens, remove unknown passkeys and MFA methods, audit OAuth and device-code grants, review app consents, constrain device-code authentication, require phishing-resistant authentication for high-risk users, and allowlist browser extensions.

AreaBreachSOC escalationTechIdentity & access
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-11
RecordCRT-2026-00552026.07.11Morning roundtable
Progress ShareFile Storage Zone Controller containment

Contain exposed ShareFile Storage Zone Controllers

Isolate or power off exposed or affected ShareFile Storage Zone Controllers now, reroute file-transfer workflows, and preserve logs or evidence where feasible.

AreaPatch prioritizationVendor claimTechSaaS collaboration
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-11
10 JULY 20265 records
RecordCRT-2026-00542026.07.10Afternoon roundtable
Cloud credential incident response

Handle reported cloud and source-control secret exposures as control-plane credential incidents

Treat reported AWS, GitHub, GovCloud, Azure, and Accenture-style secret exposures as cloud control-plane credential incidents: rotate AWS/Azure keys and tokens, invalidate sessions, contain high-risk CI/CD and automation paths, review IAM privilege chains across S3/ECS/SQS/source control, quarantine exposed repositories and forks, and validate whether claimed leaked secrets were usable.

AreaRisk acceptanceVulnerabilityTechCloud platform
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-10
RecordCRT-2026-00532026.07.10Afternoon roundtable
Software supply-chain containment

Freeze affected package lanes and audit build pipelines for reported malicious packages

Freeze only affected npm, NuGet, and package-build lanes; verify SBOMs, lockfiles, package names, versions, hashes, publishers, source repositories, and provenance; remove or replace reported affected packages after registry or vendor validation; rotate exposed CI, GitHub, cloud, payment, and wallet-related secrets if affected packages ran in developer or build environments.

AreaSupply chainTechDevOps supply chain
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-10
RecordCRT-2026-00522026.07.10Afternoon roundtable
Microsoft 365 identity containment

Restrict Microsoft 365 trust-enrollment and session-persistence paths

Restrict new passkey, security-key, authenticator, phone, and recovery-method enrollment for high-risk users to managed devices, trusted networks, or verified help-desk workflows; limit broad device-code authentication where feasible; revoke suspicious sessions, refresh tokens, OAuth grants, and attacker-added authentication methods.

AreaCampaignTechSaaS collaboration
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-10
RecordCRT-2026-00512026.07.10Morning roundtable
OT safety-led containment

Use safety-led OT containment for Poland-style disruption

Operate in loss-of-view or loss-of-control mode: verify safe manual local operation first; freeze or tightly ACL remote and vendor access; preserve firewall, VPN, and HMI logs and images; surgically isolate enterprise, DMZ, remote-access, engineering, HMI, and controller networks; validate RTU and PLC firmware or controller logic and HMI project files; rotate default and vendor credentials; and reintroduce access only through logged jump hosts.

AreaRisk acceptanceSOC escalationTechICS / OT
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-10
RecordCRT-2026-00502026.07.10Afternoon roundtable
Microsoft 365 OAuth and device-code phishing remediation

Microsoft 365 OAuth phishing requires token and consent revocation

Revoke Microsoft 365 user sessions and refresh tokens for exposed users, remove suspicious enterprise apps and service principals, revoke delegated OAuth grants, disable broad user consent, constrain device-code authorization, and require admin-reviewed consent for new OAuth permissions.

AreaPatch prioritizationVulnerabilityTechIdentity & accessSaaS collaboration
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-10
09 JULY 20263 records
RecordCRT-2026-00492026.07.09Afternoon roundtable
Enterprise mobile controls

Raise targeted Android controls for high-risk users

For high-risk users, enforce managed Play allowlists, block unknown-source installs, monitor high-risk permissions such as Accessibility, notification access, default SMS, and battery-optimization exemptions, keep Firefox/WebView/Chrome and OS components current where managed updates are available, and focus controls on finance, executives, crypto handlers, journalists or NGO contacts, and India-facing teams.

AreaPatch prioritizationTechMobile platform
SeverityMedium
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-09
RecordCRT-2026-00482026.07.09Afternoon roundtable
Developer supply-chain intake

Tighten developer supply-chain intake controls

Block unreviewed package intake through internal artifact proxies, require approval for new package names or maintainers, pin dependencies by digest, review lockfile diffs, harden GitHub Actions secrets, and verify raw Git objects and provenance rather than trusting platform labels or badges alone.

AreaPatch prioritizationSupply chainTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-09
RecordCRT-2026-00472026.07.09Afternoon roundtable
AI coding assistant containment

Constrain AI coding assistants for untrusted repositories

For untrusted repositories, disable or constrain assistant writes outside repository roots, disable auto-approval for file changes and command execution, block agent access to SSH keys, credential stores, cloud profiles, package-manager tokens, and CI/CD secrets, and use quarantine or ephemeral sandbox modes.

AreaRisk acceptanceTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-09
08 JULY 20263 records
RecordCRT-2026-00462026.07.08Afternoon roundtable
Argo CD repo-server isolation

Isolate and hunt exposed Argo CD repo-server reachability

If the Argo CD repo-server gRPC path is reachable beyond the intended Argo namespace, move it into same-day isolation and hunting: enforce network-policy isolation, freeze or tightly control sync, and review repo-server logs, Redis access, odd manifests, and unexpected syncs.

AreaPatch prioritizationSOC escalationVulnerabilityTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-07-08Prediction · due 7 AugNext checkpoint 7 Aug
RecordCRT-2026-00452026.07.08Afternoon roundtable
Identity trust-state revocation

Prioritize identity trust-state revocation over password resets

In the first 30 minutes of suspected identity exposure or token abuse, prioritize revoking sessions and refresh tokens, removing suspicious OAuth grants and service principals, restricting device-code auth, requiring phishing-resistant MFA for admins and high-risk users, and alerting on MFA, Conditional Access, OAuth, device, and impossible-travel anomalies.

AreaVulnerabilityTechIdentity & access
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-08
RecordCRT-2026-00442026.07.08Afternoon roundtable
Langflow control-plane containment

Treat exposed Langflow and AI workflow services as credential-control-plane incidents

Take exposed Langflow or related AI/developer workflow services offline or restrict access while validating exposure, freeze risky automation, rotate reachable PostgreSQL, MinIO, config, cloud, CI/CD, API, model, and payment credentials, and restore only after fresh secrets and safer permissions are in place.

AreaRisk acceptanceVulnerabilityTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-08
06 JULY 20264 records
RecordCRT-2026-00432026.07.06Afternoon roundtable
72-hour emergency security authority

Authorize temporary emergency controls for identity, mobile, edge, and AI workflow exposure

Approve concrete 72-hour authority and downtime tolerance today: force identity controls for finance and admin users, allow security to quarantine non-compliant mobile devices without business-unit delay, and authorize emergency change windows for edge and AI workflow systems, with rollback and business-risk ownership.

AreaBoard riskRisk acceptanceTechAI / ML systems
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-07-06
RecordCRT-2026-00422026.07.06Afternoon roundtable
ModSecurity and multipart upload controls

Patch or compensate exposed ModSecurity multipart endpoints

Move exposed ModSecurity deployments to a fixed vendor or distribution build as soon as one is available, prioritize reported internet-facing i386 exposure for CVE-2026-52761, and treat multipart/form-data parser bypass as the broader exposed-app risk. Until patched, place reverse proxy or upstream WAF controls in front of upload and form endpoints, tighten or disable risky multipart routes, block malformed multipart requests, normalize line endings where supported, and run validation tests.

AreaPatch prioritizationVulnerability
SeverityMedium
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-06
RecordCRT-2026-00412026.07.06Afternoon roundtable
DeFi asset-share incident containment

Run asset-share accounting incidents as first-24-hour containment

For Summer.fi/FleetCommander-style asset-share accounting incidents, prioritize first-24-hour containment over attribution debate: pause affected vault or strategy paths and related deposit, withdrawal, rebalance, mint, redeem, or share-conversion functions; snapshot balances and share supply; replay the exploit; review accounting, oracle, signer, upgrade, and treasury authority; notify users, exchanges, and bridges; and preserve traces before fixing forward.

AreaPatch prioritizationVulnerability
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-06
RecordCRT-2026-00402026.07.06Afternoon roundtable
Developer tool supply-chain containment

Treat affected developer-tool executions as credential exposure

Treat developer workstations, CI runners, and build jobs that confirmedly installed or executed affected TeamPCP, ChocoPoCs, or malicious package artifacts as exposed. Freeze risky CI/CD execution paths, disable package install scripts where feasible, force installs through artifact proxies with lockfile or hash enforcement, rotate developer, cloud, source-control, package, and API credentials, and rebuild affected runners or machines from known-good images.

AreaSupply chainVulnerabilityTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps7 references
StateActiveRev 2026-07-06
05 JULY 20269 records
RecordCRT-2026-00392026.07.05Afternoon roundtable
Agentic coding tool sandboxing

Sandbox agentic coding tools with shell, network, or file access

Organizations using coding agents with shell, network, or file access should run them in disposable sandboxes, disable unattended setup or script execution, block or alert on DNS TXT payload retrieval from developer workstations, and treat repository instructions in READMEs, issues, and package metadata as untrusted input.

AreaPatch prioritization
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-05
RecordCRT-2026-00382026.07.05Afternoon roundtable
REDCap exposure same-day response

Take same-day action for exposed REDCap in research and healthcare contexts

Research, healthcare, academic, medical, and military research organizations running legacy, unsupported, or internet-facing REDCap should take same-day action on the reported activity: restrict exposure, hunt for web shells and INFINITERED indicators, audit Google Workspace or mail routing/BCC/compliance rules, rotate REDCap-related credentials, and involve privacy/legal if sensitive patient or research data may have been accessed.

AreaPatch prioritization
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-05
RecordCRT-2026-00372026.07.05Afternoon roundtable
Trust-state containment for OAuth, token, and infostealer exposures

Treat OAuth, token, and infostealer exposure as attacker-held trust state

Treat ARToken, Klue OAuth, infostealer, and related credential exposures as attacker-held trust-state incidents rather than password-reset incidents. Revoke live sessions and refresh tokens, remove suspicious OAuth grants, kill remembered devices, rotate connected-app and integration secrets, revoke app passwords and personal access tokens, and review Microsoft 365, Salesforce, GitHub/GitLab, CI/CD, cloud, package, and mailbox activity for token use after supposed containment.

AreaRisk acceptanceVulnerabilityTechIdentity & accessSaaS collaboration
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-05
RecordCRT-2026-00362026.07.05Morning roundtable
Agentic coding tool controls

Govern agentic coding tools as untrusted code execution

Govern agentic coding tools as untrusted code execution: sandbox coding agents, block arbitrary network egress where possible, require human approval for shell and package operations, and keep secrets out of agent-accessible environments.

AreaRisk acceptance
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps3 references
StateActiveRev 2026-07-05
RecordCRT-2026-00352026.07.05Morning roundtable
Cyber-physical fleet safety

Bluetooth e-rickshaw BMS cyber-physical safety controls

Treat the issue as a real local cyber-physical safety warning: inventory Bluetooth-exposed BMS units, change or disable default credentials, require authenticated pairing, remove or block unauthorized BMS apps from fleet/driver phones, and test firmware or Bluetooth changes on a small set before fleet rollout.

AreaPatch prioritizationRisk acceptance
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps3 references
StateActiveRev 2026-07-05
RecordCRT-2026-00342026.07.05Morning roundtable
Confidential-computing architecture risk

Attested TLS confidential-computing architecture review

Review Attested TLS/confidential-computing endpoint identity binding, relay assumptions, and mTLS/service identity controls this week; treat it as medium-priority architecture risk rather than immediate incident response in this packet.

AreaBoard riskRisk acceptance
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-07-05
RecordCRT-2026-00332026.07.05Morning roundtable
Healthcare breach assessment

AdaptHealth contractor-session HIPAA assessment and preservation

Start HIPAA breach-notification assessment and preserve contractor session artifacts, IdP/session-token logs, cloud audit logs, document access records, PHI inventories, affected counts, password-reset evidence, vendor/BAA terms, and discovery timestamp.

AreaBreachRisk acceptance
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-05
RecordCRT-2026-00322026.07.05 · revMorning roundtable
Mobile patch prioritization

Android CVE-2025-48595 high-risk patch enforcement

Maintain targeted same-day enforcement for high-risk Android users for CVE-2025-48595 rather than fleetwide emergency lockdown. Use MDM and conditional access for affected high-risk groups, preserve suspicious devices for mobile forensics, and treat NFC scams and mobile phishing as fraud and identity-control lanes rather than fleetwide OS events.

AreaPatch prioritizationRisk acceptanceTechMobile platform
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-05
RecordCRT-2026-00312026.07.05Morning roundtable
Developer supply-chain response

Developer supply-chain credential containment and release-trust review

Audit packages, lockfiles, package-manager caches, CI logs, build metadata, developer endpoints, and artifact outputs; rotate exposed cloud, source-control, Kubernetes, SSH, npm, CI/CD, registry, signing, and AI/API tokens where exposure or execution is found.

AreaSupply chainTechDevOps supply chain
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-05
04 JULY 20264 records
RecordCRT-2026-00302026.07.04Afternoon roundtable
DeFi incident containment

Pause vulnerable smart-contract paths before attribution or reimbursement claims

Pause vulnerable contract, module, or execution paths; revoke or narrow privileged paths; snapshot affected balances and transaction state; publish wallet IOCs; notify issuer-side compliance, exchanges, bridges, and monitoring partners; make reimbursement decisions after affected-wallet and recoverable-balance scope is bounded.

AreaBreachPatch prioritizationRisk acceptance
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-07-04
RecordCRT-2026-00292026.07.04Afternoon roundtable
DNS delegation hygiene

Audit lame or claimable DNS delegations outside-in

Run a same-week audit of domains and subdomain delegations, including parked, forgotten, M&A, and defensive domains; compare registrar NS records to authoritative answers, verify provider account ownership, and remove stale delegation or move zones to controlled DNS. Treat partial lame delegation plus a claimable provider as exploitable for high-value domains.

AreaPatch prioritizationRisk acceptance
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-04
RecordCRT-2026-00272026.07.04Morning roundtable
AI workflow and credential exposure

Treat exposed AI workflow environments as credential-exposure risk

Inventory Langflow, Marimo, AI IDE, notebook, and browser-agent deployments. For exposed or secrets-connected systems, remove public exposure, patch or isolate Marimo-style deployments until verified fixed, rotate touched cloud/API credentials, restrict secret-store and authenticated-app access, and log agent/tool activity.

AreaPatch prioritizationVulnerabilityTechAI / ML systems
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps7 references
StateActiveRev 2026-07-04
RecordCRT-2026-00262026.07.04Morning roundtable
Software supply-chain change control

Use scoped supply-chain change control instead of a blanket engineering freeze

Do not freeze all engineering. Temporarily gate new npm or Composer dependencies, risky dependency upgrades, GitHub Actions workflow edits, Composer tag consumption, CI jobs executing third-party install scripts, package-publishing tokens, and suspicious dependency installs.

AreaPatch prioritizationSupply chainTechDevOps supply chain
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-07-04

Showing 30 records · page 13 of 14

These controls filter only the 30 records on this page. Search the full Ledger →

Unified Search

Search the public record.