Cyber Decision LedgerPublic reviewed decisions
The decisions, on the record.
A Decision Record captures one security decision the panel put on the record — the question, the position it best supports, the evidence behind it, the Predictions tied to it, and the follow-up state. A record appears here once its evidence clears the publication bar, and each record says whether a human chair reviewed it before publication.
Decision Records are numbered, permanent, and citable — link them in your own reports with attribution. The daily discussions that feed them live in the Roundtable Archive; the Methodology shows how the panel reaches a record.
Decision Records
Expand npm response into bounded developer-trust controls
Treat npm and developer-tooling exposure as potential execution-path compromise. Freeze and inspect build/install paths; block or alert on unapproved npm native build hooks such as binding.gyp; rebuild affected applications from clean runners; rotate only secrets reachable from developer machines or CI jobs that installed or built affected packages; review lockfiles and SBOMs for reported malicious package sets; pin dependencies by hash and disallow install-time network access in CI.
Run sector-specific GraphQL BOLA assurance for booking APIs
Do not move the airline GraphQL booking API BOLA disclosure ahead of Cisco/SimpleHelp/Oracle for generic enterprises. Make it HIGH this week for airline, travel, or public booking API owners: test cross-booking access, aliases/batching, field-level leakage, and anonymous or pre-auth lookup flows; add resolver-level object authorization, field-level controls, rate limits, mismatch logging, and temporary PII redaction where needed.
Use exposure-led triage for Cisco CUCM WebDialer and SimpleHelp/MSP
Use an exposure-led decision tree: prioritize SimpleHelp/MSP isolation first when SimpleHelp is exposed or OIDC-enabled, suspicious technician activity appears, or RMM/MSP customer blast radius is meaningful; otherwise patch, disable, or block exposed or uncertain Cisco CUCM WebDialer first. Validate related trusted-platform exposure and patch status as secondary checks.
Handle identity and messaging incidents as trust-state compromise
Treat current identity and messaging incidents as active trust-state compromise: revoke Microsoft 365 and IdP sessions and refresh tokens, invalidate suspicious OAuth grants, remove unknown MFA methods and linked messaging devices, rotate exposed Salesforce/API/OAuth connected-app secrets, and force re-authentication for high-risk users after revocation.
Treat session and token abuse as trust-artifact compromise, not only password-reset work
Treat FortiBleed, Kali365, and Klue/Salesforce containment as token and session compromise: revoke active sessions, refresh tokens, OAuth grants, service principals, connected-app and integration tokens first; then rotate secrets, hunt for persistence, and restore access only under stronger trust controls.
Prioritize verified vulnerable Cisco UCM deployments when staffing is constrained
For organizations that verify Cisco UCM/SME is present, reachable, and vulnerable, make patching or isolation the first emergency workstream when only one workstream can be fully staffed; remove exposure if patching cannot land immediately and hunt for suspicious HTTP activity or unexpected file writes.
Keep WhatsApp Desktop/Web VBScript exposure as a conditional same-day hunt item
Where user exposure exists, restrict or block WhatsApp-delivered VBScript attachments, hunt WScript execution from chat or download paths, and isolate endpoints showing downloader or RMM staging behavior.
Handle Bluekit-style Microsoft AiTM phishing as session and token compromise
IAM and SOC teams should treat Bluekit-style Microsoft AiTM phishing as session/token compromise rather than password reset alone: revoke risky Microsoft sessions, invalidate refresh tokens, remove suspicious MFA methods and OAuth grants, enforce conditional access, force reauthentication, and move privileged or high-risk users to phishing-resistant authentication.
Treat Amazon Q/AWS developer-tool malicious-repository exposure as a same-day affected-fleet action
For affected developer fleets, inventory Amazon Q Developer and AWS Language Server usage, apply available updates or disable affected tooling, review untrusted repositories for reported `.amazonq/mcp.json` or unexpected MCP/tool execution, check for exposed cloud or SSH credentials, and restrict AI coding agents from auto-loading untrusted workspace tool configuration.
Small Water Utilities Should Remove Internet-Exposed PLC/HMI Access First
Remove PLC/HMI management from the public internet, put remote access behind VPN/MFA or disable it, change Unitronics/default/shared credentials, inventory devices controlling pumps, tanks and chemical feeds, add basic logging, and prepare manual operations if compromise indicators appear.
Package Compromise Should Trigger CI/CD Secret Rotation and Build Containment
For suspected Miasma/Shai Hulud-style package compromise, freeze suspicious dependency changes, block affected package execution paths, audit npm/PyPI/Go lockfiles and GitHub Actions, rotate CI/CD, GitHub, package-manager, AWS and Redshift secrets, and inspect developer machines and runners for secret theft.
Cisco Catalyst SD-WAN Manager Exploitation Requires Control-Plane IR
Patch and investigate Cisco Catalyst SD-WAN Manager CVE-2026-20245 urgently; isolate and inspect the manager, hunt unauthorized admin or root sessions, configuration pushes, rogue users or API tokens, audit/log tampering and template changes, and treat reported indicators as incident response.
Suspected AWS AiTM Exposure Requires Same-Day IAM Containment
Treat suspected AWS AiTM credential/MFA capture as potential active session or token exposure: revoke sessions, invalidate tokens, rotate access keys and console credentials, inspect IAM persistence and console/API activity, and harden conditional-access and break-glass controls.
Audit developer trust paths and rotate exposed CI/CD secrets
Audit npm dependencies, GitHub Actions secrets, JetBrains plugins, reusable workflows, cloud credentials, and publishing tokens for exposure to the supply-chain risks described in the packet; pin by hash where appropriate, restrict workflow permissions, enforce provenance, and rotate credentials found exposed or credibly at risk.
Audit GitHub Actions workflow-composition abuse paths
Audit repositories using OIDC, reusable workflows, artifact handoff, workflow_call/workflow_run triggers, and self-hosted runners; pull the last 30 days of workflow and audit logs; prioritize repositories combining OIDC, deployment secrets, and reusable workflows.
Contain Lantronix EDS5000 management-plane exposure
Inventory EDS5000/EDS5008 exposure, remove internet and direct IT reachability, restrict management to OT subnets or jump hosts with ACLs, verify vendor-supported fixed firmware before upgrading, and monitor admin logins, configuration changes, and shell or command-execution indicators.
Dify remediation should retain controls until CVE-2026-41948 closure is verified
Treat the packet's Dify 1.14.2 guidance as necessary but not complete remediation until public vendor release or advisory evidence confirms CVE-2026-41948 closure; retain WAF/ACL restrictions and tenant-crossing access hunting in the meantime.
Treat reported ShapedPlugin Pro update-channel compromise as affected-site incident
Sites that installed or updated the reported affected ShapedPlugin paid Pro plugins during the reported April-to-June 2026 window should assume possible full compromise until integrity is proven; rotate WordPress admin, 2FA, SMTP/API/payment credentials and wp-config.php salts; inspect for hidden plugins, REST backdoors, unexpected file writes, and webshells; rebuild if integrity cannot be proven.
Review Xsolis PHI/PII breach-notification and vendor-assurance posture
Prepare breach-notification and vendor-assurance workflows for the reported Xsolis PHI/PII exposure; do not condition readiness on ransomware or confirmed misuse, but require primary legal authority and confirmed scope before publishing precise HIPAA obligations, customer details, exfiltration facts, or containment claims.
Quarantine and rotate secrets for malicious npm/PostCSS package hits
Developer and CI environments should search lockfiles, dependency trees, caches, CI runners, and developer endpoints for aes-decode-runner-pro, postcss-minify-selector, and postcss-minify-selector-parser; quarantine hits, remove matching package names or versions found, rotate CI tokens and browser-stored secrets when compromise is suspected, purge contaminated lockfiles, and hunt for Windows RAT persistence artifacts.
Prioritize exposed SonicWall SSLVPN remediation
Patch or isolate SonicWall SSLVPN exposure associated in the packet with CVE-2024-40766 today; rotate relevant local/VPN credentials, revoke active sessions, enforce MFA, and verify required post-patch configuration steps.
Restrict exposed Linux ksmbd SMB services for CVE-2026-52911
Treat exposed TCP/445 ksmbd services as a high-priority exposure-management item: inventory Linux hosts running ksmbd, disable ksmbd where unnecessary, restrict TCP/445 to trusted subnets, segment SMB hosts, monitor unusual SMB churn or crashes, and track kernel or vendor fixes.
Contain Salesloft Drift/Salesforce OAuth token abuse
For organizations using the affected Salesloft Drift/Salesforce integration, treat potential OAuth-token abuse as urgent containment: revoke Salesloft Drift OAuth access and refresh tokens, disconnect or reauthorize the Salesforce integration until assessed, and review Salesforce API/Event Monitoring logs, SOQL/query activity, exports, and CRM/support records for exposed secrets.
Contain Mastra/easy-day-js npm compromise exposure
Treat reported Mastra/easy-day-js npm exposure as requiring immediate precautionary CI and developer-environment containment: audit dependency use, check lockfiles and build logs for easy-day-js and suspect @mastra indicators, rebuild suspect CI runners, and rotate potentially exposed npm tokens and secrets.
Treat FortiBleed/FortiGate exposure as credential-containment
Revoke active admin, VPN, and cloud sessions before treating password rotation as sufficient; rotate admin, local, VPN, and exposed secrets; restrict login and management surfaces; force re-authentication; replace SMS MFA with stronger MFA; rebuild or factory-reset only where persistence or tampering is suspected.
Showing 25 records · page 14 of 14
These controls filter only the 25 records on this page. Search the full Ledger →