Loading roundtable session...

Expert Roundtable — June 29, 2026 morning | Halil Öztürkci

Cyber Threatcast Roundtable

Session CRT-20260629 — 29 June 2026 · Morning Edition

REACTIVE LOOP

Roundtable session complete.

10m 40s

Duration

11

Agents

9

Messages

64

Sources

2

Actions

View Briefing →

11 AGENTS

Halil Öztürkci

James Okafor

Dr. Elena Rossi

Pierre Lefevre

Lena Hartmann

Dr. Sofia Andersen

Alex Mercer

Dr. Arjun PatelSPEC

Isabelle MoreauSPEC

Marcus ValeSPEC

Tomas IlicSPEC

OPENINGModerator Briefing—

Halil ÖztürkciOPENING

This is a control-plane day, not a vulnerability-count day.

The obvious lead is the npm binding.gyp campaign: compromised maintainer accounts, install-time execution through node-gyp, and a path into CI/CD that can bypass the script-hook monitoring many teams proudly think they have covered. If that propagates through build systems, the decision is not “patch when convenient.” It may be package freeze, build-host review, and secret rotation today.

But I do not want us to miss the live infrastructure exposure. Cisco Unified Communications Manager CVE-2026-20230 is in KEV with active exploitation, and the federal deadline was June 28 — so this morning, any unpatched environment is already in exception territory. Android CVE-2025-48595 is also being exploited, limited but serious, with no user interaction.

The second lane is identity abuse: FortiBleed against Fortinet access points, Kali365 abusing Microsoft device-code login, and Klue showing how one dormant SaaS credential can become Salesforce data exfiltration downstream. That is the same story in three accents: trusted access becoming attacker infrastructure.

We will give focused airtime to the AI coding-agent prompt-injection work, because it sits right beside the npm issue: repositories are becoming execution environments, not just source code. Polymarket, SecondFi, Tata, deepfake enforcement, and the malware takedown stay as quick hits unless someone sees a decision-changing delta.

First move: I want us to test whether npm binding.gyp is truly today’s highest operational priority, or whether active exploitation of Cisco/Android should outrank it for most CISOs. Tomas and Alex will be central, but I want dissent from the room — especially from James and Marcus — before we settle on the order.

ACTION 1Parallel DispatchDISPATCH PARALLEL6m 21s

Halil→Tomas IlicSPECIALIST

Tomas IlicSoftware Supply Chain Security Analyst[2 sources]

MODERATOR DIRECTIVE

Tomas, take the lead on the npm binding.gyp/node-gyp campaign and adjacent supply-chain items from the source pack: Mastra trojanized packages, Red Hat/Miasma, AUR/Atomic Arch, TeamPCP, Amazon Q/AI-repo credential theft, and Polymarket's third-party frontend dependency compromise. I need a decision-ready position, not a recap: should engineering leaders freeze package upgrades/builds today, what exact evidence would trigger that, and what containment sequence matters most in the first 24 hours? Also say where the briefing may overstate or understate worm propagation risk.

Engineering should not impose a blanket freeze on all package upgrades and builds today. That burns the organization too broadly. But I would impose an immediate scoped freeze on: npm installs/builds that execute native build hooks, CI jobs that can publish packages, and any repositories consuming affected npm dependency paths until they are checked.

The hard trigger for a broader freeze is this: evidence that the binding.gyp/node-gyp campaign has touched your dependency graph, your internal npm proxy/cache, or any CI runner with publish tokens or cloud credentials. The visible source-pack evidence marks this as critical, active in the wild, and specifically describes it as an npm ecosystem binding.gyp supply-chain attack enabling CI/CD worm propagation across npm packages. That is enough for a targeted stop-the-line on risky build paths. For Mastra, the evidence says 116 npm organization packages were trojanized with a malicious dependency, so any org consuming Mastra packages should freeze upgrades/rebuilds involving those packages until lockfiles, package hashes, and install scripts are reviewed.

First 24 hours:

Stop publish-capable CI first, not every developer laptop. Disable npm publishing tokens, GitHub Actions release jobs, and any automation with registry write privileges.
Snapshot and inspect lockfiles/SBOMs for affected npm packages, especially native-module paths using binding.gyp/node-gyp and Mastra dependencies.
Rotate secrets exposed to build runners: npm tokens, GitHub tokens, cloud keys, package registry credentials. Treat CI secrets as potentially copied, not merely “used.”
Purge and rebuild from clean caches only after pinning exact versions and hashes. Do not trust a warmed npm cache or internal artifact proxy until it has been checked.
Block lifecycle scripts temporarily for triage builds where possible, then re-enable only for packages with verified provenance.

On worm risk: the briefing may overstate it if people hear “worm” and assume automatic internet-scale propagation across all npm users. The visible evidence supports CI/CD propagation risk, but I do not have enough visible detail here to claim universal self-replication across organizations. It may understate the risk if teams only look for direct dependencies: the blast radius lives in transitive packages, build hooks, release automation, and stolen publishing credentials.

For Red Hat/Miasma, AUR/Atomic Arch, TeamPCP, Amazon Q/AI-repo credential theft, and Polymarket’s third-party frontend dependency compromise, I don’t have enough visible evidence in this turn to make package-specific claims. I would still apply the same decision rule: freeze only where your dependency graph, build system, frontend bundle, or credential path intersects the affected component.

Sources:

[0]threats.wiz.io

[1]threats.wiz.io

Halil→Alex Mercer

Alex MercerSenior Offensive Security Researcher[35 sources]

MODERATOR DIRECTIVE

Alex, test the priority order between the active exploited vulnerabilities and the supply-chain lead. Compare Cisco Unified Communications Manager CVE-2026-20230 in KEV, Android CVE-2025-48595 limited active exploitation, Check Point CPAI-2026-8037, and the npm binding.gyp campaign. Give me exploitability, likely attacker path, and what a CISO should do tonight if they can only resource two emergency workstreams. Push back if the source pack's npm lead is miscalibrated.

Halil, my priority order is:

Cisco UCM CVE-2026-20230 — workstream one, no debate. CISA KEV/current handoff marks it as actively exploited, and Cisco describes an unauthenticated SSRF that can write files to the underlying OS and later support root escalation. That is a clean attacker path: hit exposed/accessible UCM, write to disk, escalate, then use the voice-management plane as a beachhead. Patch or isolate tonight.
npm binding.gyp campaign — workstream two, but only for orgs with real Node/CI exposure. I’m pushing back on treating this as universally higher than exploited KEV. If you build with npm in CI, publish packages, or keep GitHub/npm/cloud tokens in pipelines, this can become credential theft plus pipeline spread. If you’re not a software-heavy org, don’t let “supply chain” theater steal resources from exposed appliances.
Android CVE-2025-48595 — targeted mobile urgency, not broad enterprise war-room urgency. Google says it may be under limited, targeted exploitation, and the bulletin lists it as an Android Framework issue. Patch high-risk Android users tonight: executives, admins, legal, security staff, journalists, anyone likely to be targeted. Fleet-wide push can follow normal emergency mobile patch cadence.
Check Point CPAI-2026-8037 — validate exposure, don’t over-rank without exploitation evidence. Check Point’s advisory calls it critical and describes a directory traversal/input-validation issue. I’m not seeing the same active-exploitation signal here that Cisco and Android have. If your Check Point gateways are internet-facing, confirm versions/protection status tonight; otherwise this is rapid validation, not one of the two funded emergency streams.

I checked with James Okafor, and he lands in the same place operationally: fund Cisco first; fund npm/CI-CD second only if the organization has meaningful npm pipeline exposure. If not, swap that second stream to the most exposed Check Point estate or high-risk Android population.

Halil→Marcus ValeSPECIALIST

Marcus ValeIdentity & Access Management Architect[22 sources]

MODERATOR DIRECTIVE

Marcus, focus only on trust and access abuse: FortiBleed credential testing against Fortinet SSL VPN/management interfaces, Kali365 device-code OAuth token phishing in Microsoft 365, and Klue's dormant credential leading to Salesforce OAuth token harvesting. What is the common control failure, what should be revoked or rotated immediately, and how do we avoid pretending MFA/password resets solve token/session compromise? Give a board-ready action sequence.

The common failure is treating “successful authentication” as durable trust. FortiBleed is compromised/reused credentials against internet-accessible Fortinet admin/SSL VPN surfaces; Kali365 is OAuth device-code phishing where Microsoft 365 tokens are issued through a legitimate flow; Klue is worse for SaaS trust chains: a long-disused but still-active integration credential led to OAuth tokens being harvested for Salesforce and other platforms. In all three, the attacker does not need to “beat MFA” after tokens or sessions are already valid.

Board-ready action sequence:

Declare token/session compromise, not just credential compromise. Password resets are not containment until active sessions, refresh tokens, OAuth grants, and integration tokens are revoked.
Revoke immediately.
- Fortinet: kill active SSL VPN/admin sessions; rotate Fortinet local/admin/VPN credentials; remove unauthorized or unnecessary accounts; restrict management interfaces off the public internet.
- Microsoft 365/Kali365: revoke affected users’ Entra ID refresh tokens and sessions; remove unauthorized OAuth consent grants/service principals; block or tightly constrain device-code authentication unless explicitly needed.
- Klue/Salesforce: disconnect impacted Klue integrations; revoke Salesforce/Gong connected-app OAuth tokens and refresh tokens; rotate integration credentials/client secrets; delete the dormant credential path.
Rotate after revocation. Rotate passwords, service-account secrets, API keys, OAuth client secrets, certificates, and any directory bind accounts used by VPNs or SaaS integrations. Rotation before revocation leaves the attacker’s issued tokens alive.
Hunt for persistence. Check Fortinet admin/VPN login history, Entra device-code sign-ins and OAuth consent events, Salesforce API activity via Klue-connected apps, new MFA methods, rogue service principals, and unusual refresh-token use.
Reopen access only under stronger trust rules. Phishing-resistant MFA for administrators and high-risk users, no public firewall management, short-lived tokens, least-privilege OAuth scopes, formal retirement of dormant integrations, and recurring OAuth grant reviews.

My board message would be simple: MFA and password resets prevent future logins; they do not invalidate yesterday’s trust. The control objective is revoke, rotate, verify, then restore.

Halil→James Okafor

James OkaforSenior Defense Architect & Incident Response Lead[5 sources]

MODERATOR DIRECTIVE

James, listen across the whole source pack as the operational closer: assume a CISO has 30 minutes before an executive briefing and cannot do everything. Build the triage order for the next 24 hours across npm/CI-CD exposure, Cisco UC KEV, Android targeted exploitation, FortiBleed/Kali365 identity abuse, Klue/Salesforce downstream risk, and Check Point Gateway. I want concrete sequencing: what to stop, patch, hunt, revoke, or monitor first — and what we deliberately leave as quick-hit monitoring.

I’d brief the CISO with this order: first stop the npm/CI-CD blast path, because the source pack flags active CI/CD worm propagation across npm packages. Freeze package publishing, block suspect lifecycle scripts in CI, rotate npm/GitHub/CI tokens exposed to affected builds, and review recent pipeline runs for unexpected package publish, credential access, or dependency changes. In parallel, patch or isolate Cisco Unified CM / SME now: CVE-2026-20230 is in CISA KEV, actively exploited, remotely reachable without auth, and can write files to the appliance — that is perimeter-to-root territory. If patching cannot land today, remove internet exposure and restrict management/UI access to admin VPN only.

Second: identity containment. For FortiBleed and Kali365, treat this as credential/session abuse until proven otherwise: revoke Fortinet admin/API credentials, rotate VPN/service secrets tied to Fortinet devices, kill suspicious Microsoft 365 sessions, block device-code phishing where feasible, and hunt for abnormal OAuth/device-code sign-ins. Android targeted exploitation is not estate-wide panic patching: identify executives, legal, finance, security staff, journalists, and admins on Android first; push the latest Android security update to them, then monitor for mobile EDR alerts and unusual account access from mobile sessions.

What I’d deliberately leave as quick-hit monitoring for the next 24 hours: Klue/Salesforce downstream risk and Check Point Gateway, unless your environment has direct exposure or confirmed vendor-affected versions. For Salesforce/Klue: monitor connected apps, API token use, new OAuth grants, bulk exports, and unusual CRM access. For Check Point Gateway: validate exposure, watch for traversal-style web requests, and queue patch testing unless the gateway is internet-facing or logging shows probing. Don’t spread the SOC thin — stop the CI/CD worm path, close Cisco, revoke identity abuse paths, then monitor the rest with high-signal checks.

Halil ÖztürkciCHECKPOINT

What we have learned so far is that the room is not treating this as a single-lane incident. There are at least three urgent tracks: exposed exploited infrastructure, software supply-chain blast radius, and identity/session abuse. Tomas drew an important boundary on the npm issue: not a blanket enterprise freeze, but an immediate scoped stop on risky npm/native-build and publish-capable CI paths, especially where binding.gyp, node-gyp, internal package caches, CI runners, publish tokens, or cloud credentials could be involved. That gives us a practical containment shape without shutting down engineering everywhere.

Alex sharpened the competing priority question. His view is that Cisco Unified Communications Manager CVE-2026-20230, because it is in CISA KEV and described as unauthenticated, remotely reachable, file-writing, and potentially leading toward root-level control, should be the first workstream for organizations with exposed or accessible UCM. He placed the npm campaign second, but with a strong qualifier: if the organization has serious Node, CI/CD, package publishing, or embedded pipeline secrets, the supply-chain issue can become a credential-theft and propagation event very quickly. Android, in his framing, is urgent for targeted high-risk users, not a broad enterprise panic.

Marcus brought the identity pattern into focus: these cases are not simply “password compromise.” FortiBleed, Kali365, and Klue all show attackers abusing valid access paths, sessions, OAuth flows, or stale integrations. So containment has to include revoking sessions, refresh tokens, OAuth grants, service principals, and integration credentials — not just forcing password resets.

James then gave us the operational CISO version: in the next 24 hours, stop the npm/CI-CD blast path first, while patching or isolating Cisco UCM in parallel, then move hard on identity containment and targeted Android patching. The unresolved tension is now clear: should npm/CI-CD containment really be first overall, or does an actively exploited KEV appliance with unauthenticated reachability outrank it? That is exactly where we turn next, by challenging James’s ordering against Alex’s Cisco-first argument.

ACTION 2ChallengeCHALLENGE47s

Halil→James Okafor

James OkaforSenior Defense Architect & Incident Response Lead

MODERATOR DIRECTIVE

Claim: You put npm/CI-CD blast-path containment first in the 24-hour triage order.
Counter-evidence: Alex argues Cisco Unified Communications Manager CVE-2026-20230 should be workstream one 'no debate' because it is in CISA KEV, actively exploited, unauthenticated SSRF with file write to the underlying OS and possible root escalation. Reconcile this for a CISO who cannot fully staff both at once: what is truly first, what runs in parallel, and what evidence would flip the priority?

I’ll tighten my call: if the CISO can only fully staff one workstream tonight, Cisco UCM is first. Alex is right on the operational priority because the evidence is stronger and cleaner: CVE-2026-20230 is marked active in-the-wild/KEV-level in the handoff, unauthenticated, and can write files to the underlying OS with possible root escalation. That gets the full incident lane: isolate exposed UCM, patch/fix if available after a fast smoke test, and hunt for unexpected file writes or suspicious HTTP activity.

npm/CI-CD still runs in parallel, but as a containment sprint unless exposure is confirmed: freeze package publishing, disable risky pipeline token use, and check recent CI runs/dependency changes. It flips above Cisco only if Cisco UCM is not present/not reachable/not vulnerable, or if npm evidence shows direct exposure — affected package in your build graph, maintainer/registry token exposure, suspicious CI execution, or outbound publishing from pipelines. Otherwise npm is the second lane, not the first fully staffed lane.

Halil ÖztürkciCHECKPOINT

That challenge helped the room resolve an important ordering issue. James has narrowed his earlier position: if there is only enough staffing to fully drive one workstream tonight, Cisco Unified Communications Manager CVE-2026-20230 comes first. The reason is not that the npm and CI/CD concern is unimportant, but that the Cisco evidence is cleaner and more immediately actionable in the handoff: active exploitation, KEV-level urgency, unauthenticated SSRF, file-write capability to the underlying OS, and possible root escalation. That combination moves it into a full incident-response lane rather than a general hardening lane.

The practical takeaway is that exposed UCM should be isolated, patched or fixed after a fast smoke test where possible, and investigated for suspicious HTTP activity or unexpected file writes. The room is not saying every organization definitely has vulnerable Cisco UCM exposed, nor that exploitation is confirmed in every environment. The priority depends on presence, reachability, and vulnerability. But where those conditions hold, this is the first staffed workstream.

At the same time, npm and CI/CD do not disappear. They remain a parallel containment sprint: freeze package publishing, restrict risky pipeline token usage, and review recent CI runs and dependency changes. James also gave us the condition under which that lane can overtake Cisco: if UCM is absent, unreachable, or not vulnerable, or if there is concrete npm-side exposure such as an affected package in the build graph, maintainer or registry token exposure, suspicious CI execution, or outbound publishing from pipelines.

So the synthesis is now clearer: lead with confirmed exploited infrastructure risk when it is present and reachable, while keeping supply-chain containment running in parallel so it can escalate quickly if direct exposure appears.

Halil ÖztürkciCLOSING

Roundtable session complete. Cisco UCM patching/isolation was prioritized first under constrained staffing, with scoped npm/CI/CD containment running in parallel.

Key Findings

1

James revised his triage after Alex’s challenge: if only one workstream can be fully staffed tonight, Cisco UCM comes first; npm/CI-CD containment runs in parallel with scoped freezes and build-host review.

2

Tomas advises against a blanket engineering freeze, but supports an immediate scoped freeze for npm installs/builds involving native build hooks, CI jobs with publish rights, and repositories connected to high-value secrets.

3

Marcus frames FortiBleed, Kali365, and Klue as trust-state failures, not password failures: password resets alone do not invalidate OAuth tokens, active sessions, VPN persistence, or downstream SaaS access.

4

Android CVE-2025-48595 is urgent for managed mobile fleets, especially high-risk users, but the panel treats it as a targeted patch-compliance sprint rather than the top enterprise-wide containment event.

Action Items

CRITICAL

Patch or isolate Cisco Unified Communications Manager deployments affected by CVE-2026-20230 immediately; verify internet exposure and hunt for signs of exploitation.

CRITICAL

Impose a scoped npm/CI-CD containment pause: review recent installs for binding.gyp/node-gyp execution, protect publish-capable CI jobs, rotate exposed build secrets, and treat affected build hosts as suspect until cleared.

HIGH

Revoke and reissue trust artifacts tied to Fortinet, Microsoft 365, Salesforce, and CI/CD access: active sessions, OAuth grants, API tokens, service credentials, and dormant third-party credentials.

HIGH

Push Android June 2026 security updates to managed Android 14/15/16 fleets, prioritizing executives, administrators, legal, engineering, and other high-value mobile users.

MEDIUM

Keep Polymarket, Klue downstream exposure, Check Point CPAI-2026-8037, AI coding-agent prompt injection, and deepfake fraud enforcement in the monitoring/targeted-response lane unless new exploitation or customer exposure evidence appears.

Consulted during analysis

James OkaforSenior Defense Architect & Incident Response LeadDEF

Alex asked:James, I’m comparing tonight’s emergency priorities. Evidence I have: Cisco UCM CVE-2026-20230 is in CISA KEV/current handoff as active in-the-wild; Cisco describes unauth SSRF via crafted HTTP requests, file write to the OS, and possible root escalation, with WebDialer disabled by default. Android CVE-2025-48595 is in the June 2026 bulletin with indications of limited targeted exploitation, an integer-overflow/code-exec issue leading to local privilege escalation. Check Point CPAI-2026-8037 is a critical directory traversal advisory/sensitive files issue, but I don’t have visible in-the-wild evidence. The npm binding.gyp lead is under-sourced in the visible evidence I can cite. If a CISO can fund only two emergency workstreams tonight, would you prioritize Cisco UCM plus mobile patching, or swap in Check Point/npm because of defensive blast radius?

Alex, I’d fund Cisco UCM first, no debate: the handoff has CVE-2026-20230 as active in-the-wild and KEV-level urgency, with unauthenticated remote reachability and OS file-write/root escalation potential. For the second workstream, I would swap mobile patching out unless the organisation has a defined high-risk Android population. The evidence says Android is limited targeted exploitation, so push emergency updates to executives/admins/security/legal as part of endpoint ops, but don’t burn a full war-room stream on the whole fleet tonight.

My second funded stream would be npm/CI-CD if they build or publish Node packages, run npm in CI, or hold registry/GitHub tokens in pipelines; worm propagation plus credential-bearing CI has bigger defensive blast radius than a single mobile CVE. If they do not have meaningful npm/CI exposure, then take Check Point Gateway as the second stream only where gateways are internet-facing or affected versions are confirmed; otherwise leave Check Point on rapid exposure validation plus monitoring, because I’m not seeing visible in-the-wild evidence for CPAI-2026-8037 here.

securityboulevard.com threats.wiz.io advisories.checkpoint.com vietnam.vn

ask_expert31.9s✓4 sources