Cyber Decision LedgerPublic reviewed decisions

The decisions, on the record.

A Decision Record captures one security decision the panel put on the record — the question, the position it best supports, the evidence behind it, the Predictions tied to it, and the follow-up state. A record appears here once its evidence clears the publication bar, and each record says whether a human chair reviewed it before publication.

Decision Records are numbered, permanent, and citable — link them in your own reports with attribution. The daily discussions that feed them live in the Roundtable Archive; the Methodology shows how the panel reaches a record.

Filter this page · applies instantlyNo filters active · showing all records25 shown
Sort

Decision Records

30 JUNE 20264 records
RecordCRT-2026-00252026.06.30 · revMorning roundtable
Software supply-chain containment

Expand npm response into bounded developer-trust controls

Treat npm and developer-tooling exposure as potential execution-path compromise. Freeze and inspect build/install paths; block or alert on unapproved npm native build hooks such as binding.gyp; rebuild affected applications from clean runners; rotate only secrets reachable from developer machines or CI jobs that installed or built affected packages; review lockfiles and SBOMs for reported malicious package sets; pin dependencies by hash and disallow install-time network access in CI.

AreaPatch prioritizationSupply chainTechDevOps supply chain
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-07-16
RecordCRT-2026-00242026.06.30Morning roundtable
API authorization assurance

Run sector-specific GraphQL BOLA assurance for booking APIs

Do not move the airline GraphQL booking API BOLA disclosure ahead of Cisco/SimpleHelp/Oracle for generic enterprises. Make it HIGH this week for airline, travel, or public booking API owners: test cross-booking access, aliases/batching, field-level leakage, and anonymous or pre-auth lookup flows; add resolver-level object authorization, field-level controls, rate limits, mismatch logging, and temporary PII redaction where needed.

AreaPatch prioritizationTechWeb application
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps4 references
StateActiveRev 2026-06-30
RecordCRT-2026-00232026.06.30Morning roundtable
Patch and isolation prioritization

Use exposure-led triage for Cisco CUCM WebDialer and SimpleHelp/MSP

Use an exposure-led decision tree: prioritize SimpleHelp/MSP isolation first when SimpleHelp is exposed or OIDC-enabled, suspicious technician activity appears, or RMM/MSP customer blast radius is meaningful; otherwise patch, disable, or block exposed or uncertain Cisco CUCM WebDialer first. Validate related trusted-platform exposure and patch status as secondary checks.

AreaPatch prioritization
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-06-30
RecordCRT-2026-00222026.06.30Morning roundtable
Identity incident containment

Handle identity and messaging incidents as trust-state compromise

Treat current identity and messaging incidents as active trust-state compromise: revoke Microsoft 365 and IdP sessions and refresh tokens, invalidate suspicious OAuth grants, remove unknown MFA methods and linked messaging devices, rotate exposed Salesforce/API/OAuth connected-app secrets, and force re-authentication for high-risk users after revocation.

AreaBreachSOC escalationTechSaaS collaboration
SeveritySeverity was not recorded when this record was first published.
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-06-30
29 JUNE 20262 records
RecordCRT-2026-00212026.06.29Morning roundtable
Trust-artifact containment for Fortinet, Microsoft 365, and Salesforce-linked integrations

Treat session and token abuse as trust-artifact compromise, not only password-reset work

Treat FortiBleed, Kali365, and Klue/Salesforce containment as token and session compromise: revoke active sessions, refresh tokens, OAuth grants, service principals, connected-app and integration tokens first; then rotate secrets, hunt for persistence, and restore access only under stronger trust controls.

AreaPatch prioritizationTechSaaS collaboration
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps7 references
StateActiveRev 2026-06-29
RecordCRT-2026-00202026.06.29Morning roundtable
Cisco UCM emergency patch or isolation prioritization

Prioritize verified vulnerable Cisco UCM deployments when staffing is constrained

For organizations that verify Cisco UCM/SME is present, reachable, and vulnerable, make patching or isolation the first emergency workstream when only one workstream can be fully staffed; remove exposure if patching cannot land immediately and hunt for suspicious HTTP activity or unexpected file writes.

AreaPatch prioritizationRisk acceptanceTechNetwork infrastructure
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps8 references
StateActiveRev 2026-06-29
28 JUNE 20267 records
RecordCRT-2026-00192026.06.28Afternoon roundtable
WhatsApp Desktop/Web VBScript containment and hunting

Keep WhatsApp Desktop/Web VBScript exposure as a conditional same-day hunt item

Where user exposure exists, restrict or block WhatsApp-delivered VBScript attachments, hunt WScript execution from chat or download paths, and isolate endpoints showing downloader or RMM staging behavior.

AreaPatch prioritizationSOC escalationThreat actor
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-06-28
RecordCRT-2026-00182026.06.28Afternoon roundtable
Bluekit-style Microsoft AiTM session-token response

Handle Bluekit-style Microsoft AiTM phishing as session and token compromise

IAM and SOC teams should treat Bluekit-style Microsoft AiTM phishing as session/token compromise rather than password reset alone: revoke risky Microsoft sessions, invalidate refresh tokens, remove suspicious MFA methods and OAuth grants, enforce conditional access, force reauthentication, and move privileged or high-risk users to phishing-resistant authentication.

AreaSOC escalationVulnerabilityTechIdentity & access
SeverityCritical
Evidence and confidence0/9 backed · 2 gaps7 references
StateActiveRev 2026-06-28
RecordCRT-2026-00172026.06.28Afternoon roundtable
Amazon Q/AWS developer tooling malicious-repository exposure

Treat Amazon Q/AWS developer-tool malicious-repository exposure as a same-day affected-fleet action

For affected developer fleets, inventory Amazon Q Developer and AWS Language Server usage, apply available updates or disable affected tooling, review untrusted repositories for reported `.amazonq/mcp.json` or unexpected MCP/tool execution, check for exposed cloud or SSH credentials, and restrict AI coding agents from auto-loading untrusted workspace tool configuration.

AreaPatch prioritizationVulnerabilityTechCloud platform
SeverityCritical
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-06-28
RecordCRT-2026-00162026.06.28Morning roundtable
Water utility OT exposure reduction

Small Water Utilities Should Remove Internet-Exposed PLC/HMI Access First

Remove PLC/HMI management from the public internet, put remote access behind VPN/MFA or disable it, change Unitronics/default/shared credentials, inventory devices controlling pumps, tanks and chemical feeds, add basic logging, and prepare manual operations if compromise indicators appear.

AreaPatch prioritizationVulnerabilityTechICS / OT
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-06-28
RecordCRT-2026-00152026.06.28Morning roundtable
Software supply-chain CI/CD containment

Package Compromise Should Trigger CI/CD Secret Rotation and Build Containment

For suspected Miasma/Shai Hulud-style package compromise, freeze suspicious dependency changes, block affected package execution paths, audit npm/PyPI/Go lockfiles and GitHub Actions, rotate CI/CD, GitHub, package-manager, AWS and Redshift secrets, and inspect developer machines and runners for secret theft.

AreaSupply chainVulnerabilityTechCloud platformDevOps supply chain
SeverityCritical
Evidence and confidence0/9 backed · 2 gaps8 references
StateActiveRev 2026-06-28
RecordCRT-2026-00142026.06.28Morning roundtable
Cisco Catalyst SD-WAN Manager incident response

Cisco Catalyst SD-WAN Manager Exploitation Requires Control-Plane IR

Patch and investigate Cisco Catalyst SD-WAN Manager CVE-2026-20245 urgently; isolate and inspect the manager, hunt unauthorized admin or root sessions, configuration pushes, rogue users or API tokens, audit/log tampering and template changes, and treat reported indicators as incident response.

AreaPatch prioritizationSOC escalationTechNetwork infrastructure
SeverityCritical
Evidence and confidence0/9 backed · 2 gaps7 references
StateActiveRev 2026-06-28
RecordCRT-2026-00132026.06.28Morning roundtable
AWS AiTM IAM containment

Suspected AWS AiTM Exposure Requires Same-Day IAM Containment

Treat suspected AWS AiTM credential/MFA capture as potential active session or token exposure: revoke sessions, invalidate tokens, rotate access keys and console credentials, inspect IAM persistence and console/API activity, and harden conditional-access and break-glass controls.

AreaSOC escalationThreat actorTechCloud platform
SeverityCritical
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-06-28
26 JUNE 20261 record
RecordCRT-2026-00122026.06.26Morning roundtable
Developer supply-chain trust-path audit and secret rotation

Audit developer trust paths and rotate exposed CI/CD secrets

Audit npm dependencies, GitHub Actions secrets, JetBrains plugins, reusable workflows, cloud credentials, and publishing tokens for exposure to the supply-chain risks described in the packet; pin by hash where appropriate, restrict workflow permissions, enforce provenance, and rotate credentials found exposed or credibly at risk.

AreaSupply chainTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-06-26
25 JUNE 202611 records
RecordCRT-2026-00112026.06.25Afternoon roundtable
CI/CD supply-chain workflow audit

Audit GitHub Actions workflow-composition abuse paths

Audit repositories using OIDC, reusable workflows, artifact handoff, workflow_call/workflow_run triggers, and self-hosted runners; pull the last 30 days of workflow and audit logs; prioritize repositories combining OIDC, deployment secrets, and reusable workflows.

AreaSupply chainTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-06-25
RecordCRT-2026-00102026.06.25Afternoon roundtable
Lantronix EDS5000 CVE-2025-67038 OT containment

Contain Lantronix EDS5000 management-plane exposure

Inventory EDS5000/EDS5008 exposure, remove internet and direct IT reachability, restrict management to OT subnets or jump hosts with ACLs, verify vendor-supported fixed firmware before upgrading, and monitor admin logins, configuration changes, and shell or command-execution indicators.

AreaPatch prioritizationRisk acceptanceTechICS / OTNetwork infrastructure
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-06-25
RecordCRT-2026-00092026.06.25Afternoon roundtable
Dify CVE-2026-41948 compensating controls

Dify remediation should retain controls until CVE-2026-41948 closure is verified

Treat the packet's Dify 1.14.2 guidance as necessary but not complete remediation until public vendor release or advisory evidence confirms CVE-2026-41948 closure; retain WAF/ACL restrictions and tenant-crossing access hunting in the meantime.

AreaPatch prioritizationVendor claim
SeverityCritical
Evidence and confidence0/9 backed · 2 gaps6 references
StateActiveRev 2026-06-25
RecordCRT-2026-00082026.06.25Morning roundtable
ShapedPlugin Pro supply-chain containment

Treat reported ShapedPlugin Pro update-channel compromise as affected-site incident

Sites that installed or updated the reported affected ShapedPlugin paid Pro plugins during the reported April-to-June 2026 window should assume possible full compromise until integrity is proven; rotate WordPress admin, 2FA, SMTP/API/payment credentials and wp-config.php salts; inspect for hidden plugins, REST backdoors, unexpected file writes, and webshells; rebuild if integrity cannot be proven.

AreaBreachPatch prioritizationSupply chainTechWeb application
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-06-25
RecordCRT-2026-00072026.06.25Morning roundtable
Xsolis HIPAA breach-notification and vendor assurance

Review Xsolis PHI/PII breach-notification and vendor-assurance posture

Prepare breach-notification and vendor-assurance workflows for the reported Xsolis PHI/PII exposure; do not condition readiness on ransomware or confirmed misuse, but require primary legal authority and confirmed scope before publishing precise HIPAA obligations, customer details, exfiltration facts, or containment claims.

AreaBreachVendor claim
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-06-25
RecordCRT-2026-00062026.06.25Morning roundtable
npm/PostCSS supply-chain containment

Quarantine and rotate secrets for malicious npm/PostCSS package hits

Developer and CI environments should search lockfiles, dependency trees, caches, CI runners, and developer endpoints for aes-decode-runner-pro, postcss-minify-selector, and postcss-minify-selector-parser; quarantine hits, remove matching package names or versions found, rotate CI tokens and browser-stored secrets when compromise is suspected, purge contaminated lockfiles, and hunt for Windows RAT persistence artifacts.

AreaSupply chainVulnerabilityTechDevOps supply chain
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps5 references
StateActiveRev 2026-06-25
RecordCRT-2026-00052026.06.25Afternoon roundtable
SonicWall SSLVPN exposure remediation

Prioritize exposed SonicWall SSLVPN remediation

Patch or isolate SonicWall SSLVPN exposure associated in the packet with CVE-2024-40766 today; rotate relevant local/VPN credentials, revoke active sessions, enforce MFA, and verify required post-patch configuration steps.

AreaPatch prioritizationTechIdentity & accessNetwork security
SeverityCritical
Evidence and confidence0/9 backed · 2 gaps3 references
StateActiveRev 2026-06-25
RecordCRT-2026-00042026.06.25Morning roundtable
ksmbd exposure reduction

Restrict exposed Linux ksmbd SMB services for CVE-2026-52911

Treat exposed TCP/445 ksmbd services as a high-priority exposure-management item: inventory Linux hosts running ksmbd, disable ksmbd where unnecessary, restrict TCP/445 to trusted subnets, segment SMB hosts, monitor unusual SMB churn or crashes, and track kernel or vendor fixes.

AreaPatch prioritizationTechOS platform
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps3 references
StateActiveRev 2026-06-25
RecordCRT-2026-00032026.06.25Afternoon roundtable
Salesloft Drift/Salesforce OAuth token containment

Contain Salesloft Drift/Salesforce OAuth token abuse

For organizations using the affected Salesloft Drift/Salesforce integration, treat potential OAuth-token abuse as urgent containment: revoke Salesloft Drift OAuth access and refresh tokens, disconnect or reauthorize the Salesforce integration until assessed, and review Salesforce API/Event Monitoring logs, SOQL/query activity, exports, and CRM/support records for exposed secrets.

AreaPatch prioritizationVulnerabilityTechIdentity & accessSaaS collaboration
SeverityCritical
Evidence and confidence0/9 backed · 2 gaps3 references
StateActiveRev 2026-06-25
RecordCRT-2026-00022026.06.25Morning roundtable
Mastra npm supply-chain containment

Contain Mastra/easy-day-js npm compromise exposure

Treat reported Mastra/easy-day-js npm exposure as requiring immediate precautionary CI and developer-environment containment: audit dependency use, check lockfiles and build logs for easy-day-js and suspect @mastra indicators, rebuild suspect CI runners, and rotate potentially exposed npm tokens and secrets.

AreaRisk acceptanceSupply chainTechDevOps supply chain
SeverityCritical
Evidence and confidence0/9 backed · 2 gaps3 references
StateActiveRev 2026-06-25
RecordCRT-2026-00012026.06.25 · revAfternoon roundtable
FortiBleed/FortiGate containment and credential rotation

Treat FortiBleed/FortiGate exposure as credential-containment

Revoke active admin, VPN, and cloud sessions before treating password rotation as sufficient; rotate admin, local, VPN, and exposed secrets; restrict login and management surfaces; force re-authentication; replace SMS MFA with stronger MFA; rebuild or factory-reset only where persistence or tampering is suspected.

AreaPatch prioritizationRisk acceptanceVulnerabilityTechNetwork security
SeverityHigh
Evidence and confidence0/9 backed · 2 gaps3 references
StateActiveRev 2026-07-20Prediction · Abandoned

Showing 25 records · page 14 of 14

These controls filter only the 25 records on this page. Search the full Ledger →

End of public ledger · new records publish as their evidence clears the barLedger movement (RSS) →

Unified Search

Search the public record.