Session CRT-20260722 — 22 July 2026 · Afternoon Edition

What sharpened here is that several very different-looking incidents collapse into the same operational question: which trust paths survive after the obvious patch, password reset, or appliance reboot? Priya framed the cloud side as delegated trust — Graph permissions, OAuth grants, refresh tokens, app consents, mailbox access, and calendar objects can all become the durable access layer. Maya made the same point from the execution path: hunt from w3wp.exe, SharePoint/IIS writes, ASP.NET compilation, suspicious calendar artifacts, and AI/ML workload behavior, rather than getting distracted by family names.

The board-level prioritization also became more disciplined. Pierre put PAN-OS in the top 24–72 hour disruption lane because, in this thread, that is the item with visible active ransomware exploitation by Qilin actors. Oracle ERP/EBS exposure sits close behind as an executive-maintenance and exposure-mapping problem, especially where external integrations, SSO, supplier portals, or customer data are involved. He was careful not to rank every scary item equally; that matters, because “everything is emergency” is not a usable board decision.

Sofia added the legal guardrails: exploitation tied to Estée Lauder and Oracle EBS moves into breach-assessment, evidence preservation, and customer-data mapping now. But for exposed SharePoint, ServiceNow, SonicWall, and PAN-OS, exposure alone is not the same as a reportable breach. The action is to preserve logs, document the exposure window, identify what regulated data or critical operations were reachable, and avoid premature notification until facts support it. She also caveated that precise statutory clocks were not verified in the visible evidence here.

So the room now has three competing but compatible pressures: assume compromise where persistence is plausible, prioritize disruption risk where active ransomware evidence exists, and preserve evidence before cleanup destroys the legal record. James is the right next voice to close this into an executable defensive architecture: what goes into the assumed-compromise queue tonight, what can be monitored with compensating controls, and where identity, edge, SaaS, ERP, and AI infrastructure need one integrated containment plan.

The operational split is now much cleaner: tonight is about interrupting ransomware pathways; tomorrow is about repairing the trust fabric those pathways may have damaged. James did not flatten all exposed systems into the same treatment. He put internet-facing PAN-OS in the first emergency-change lane when it is in the affected set, because the discussion has tied that exposure to active exploitation and ransomware intrusion risk. But he also reinforced Alex’s point that SonicWall SMA1000 cannot be treated as a simple “apply the hotfix and move on” case.

The important addition is the sequence. For SMA1000, the room heard that the visible evidence points to active exploitation of CVE-2026-15409 and CVE-2026-15410 on vulnerable 12.4.3 and 12.5.0 branches, with hotfixes named as 12.4.3-03453 and 12.5.0-02835, and no meaningful workaround. More importantly, the claimed attacker outcomes include stolen credentials, sessions, and TOTP MFA seed data. That means the appliance is not just a vulnerable box; it may be a trust-extraction point. James’s containment path was therefore: restrict or isolate exposed management and VPN surfaces, preserve configurations and logs where feasible, snapshot or image before changes if practical, smoke-test and patch, and if compromise is indicated, reimage or redeploy before restoring service.

The caveat is that this answer is strongest where the evidence is strongest: PAN-OS and SMA1000, especially exposed systems in affected versions. It does not fully prove the same level of urgency for every named technology in the earlier assumed-compromise bucket. And James explicitly aligned with Marcus and Priya on a key investigative point: do not blindly rotate secrets first if doing so destroys the trail needed to understand what was stolen and where it was used.

That sets up the next challenge naturally. We now need to test the boundary of the assumed-compromise label for SharePoint and Langflow: are they in the same emergency lane based on current evidence, or should they stay conditional on exposure, version, observed indicators, and confirmed advisory data?

SharePoint and Langflow have just moved from “validate before prioritizing” into the emergency decision lane when they are exposed. James accepted the challenge and changed the triage order: the handoff evidence is enough, in his view, to treat internet- or partner-facing SharePoint as an active-exploitation problem, not a secondary patch-management item. He also elevated exposed Langflow because the evidence ties CVE-2025-3248 to ransomware activity against AI and ML assets.

The practical consequence is that tonight’s queue is no longer just edge appliances first. Exposed SharePoint now competes at the very front, especially on on-prem Server Subscription Edition, 2019, or 2016 instances that are public-facing or partner-facing. PAN-OS and SonicWall SMA1000 still remain urgent on the edge side, but Langflow also gets immediate containment if exposed — offline or tightly restricted even before an ordinary patch window. For non-exposed instances, James did not say “ignore them”; he moved them into rapid validation rather than passive monitoring.

The caveat is important: we are still operating from the handoff evidence in the room, not from fresh independent verification during this exchange. So the strongest recommendation applies where exposure and product applicability line up with the cited claims. But the burden of proof has shifted: teams should not wait for perfect certainty before preserving SharePoint logs, webroots, possible ASPX or webshell artifacts, PowerShell history, timer job changes, configuration backups, and machine-key material before rotation.

That gives us the infrastructure emergency picture. The next turn widens the lens from exploited systems to exploited trust: Isabelle is being asked to assess synthetic-media and spoofed-recovery signals, where the harm may not start with a server compromise at all, but with victims being manipulated into re-engagement, credential loss, or financial follow-on fraud.

The synthetic-media thread clarified that the immediate risk is not “deepfakes” as a standalone technology problem; it is trust being transferred to the wrong signal. Isabelle framed the three cases as the same control failure in different forms: victims trusting a supposed recovery authority, a school community reacting to a fabricated voice with institutional authority, and audiences being pushed by military-themed influence content where attribution needs to stay carefully bounded.

The room also got a practical line from her: this week’s response does not have to start with buying a detection platform. It can start with channel verification and workflow hardening. Recovery offers become a high-risk category. Claims from FBI/IC3, law enforcement, banks, exchanges, investigators, or recovery agents should trigger a stop-and-recontact rule through a known official channel, manually typed or otherwise independently verified. The important operational point is that staff should not continue through links, social messages, lookalike portals, or emotionally urgent instructions, and they should not release PII, wallet details, banking data, or fees without secondary verification.

There is also a caveat worth preserving. For the Polish-soldier videos, Isabelle did not independently attribute the operation from the media description alone. She treated it as NASK’s attribution to a Russian-origin influence effort. That distinction matters because the response can still be firm — label, verify, avoid amplification, and brief staff on manipulation patterns — without overstating what this roundtable has personally proven.

With no further action queued, we are now ready to pull the threads together: emergency exposure triage on actively exploited enterprise systems on one side, and human-trust controls for synthetic media and fraud on the other. The common theme is decision speed under uncertainty: act where the evidence is strong enough for protection, but keep the language precise where attribution or technical validation is incomplete.