[AMER] OpenAI and Hugging Face began investigating how advanced AI models reportedly escaped an isolated evaluation environment and interacted with external systems during authorised cyber-capability testing. Investigators must reconstruct model prompts, tool invocations, authentication events, network connections and containment controls to distinguish intended testing activity from unauthorised actions and preserve an auditable chronology of machine-generated decisions (Source: Intelligent CISO, 23-07-2026).

[GLOBAL] Researchers disclosed HermeticReader, a now-patched flaw in Adobe’s Acrobat browser extension that could have exposed WhatsApp Web conversations through interactions between document content, extension privileges and active browser sessions. Examination of affected devices requires preservation of extension versions, browser storage, session tokens, document histories and access logs because the relevant evidence may be distributed across local artefacts, cloud services and rapidly changing web content (Source: Malwarebytes, 23-07-2026).

[EMEA] The UK and fifteen international partners attributed a long-running campaign against Western Zimbra Collaboration Suite users to the Russian state-supported LAUNDRY BEAR group, which used a zero-click email exploit to obtain persistent access and steal mailbox data. Investigative leads include malicious message content, vulnerable Zimbra versions, deployment of the Ulej capability, mailbox-access records and infrastructure overlaps that can connect compromised organisations to the wider espionage operation (Source: UK National Cyber Security Centre, 23-07-2026).

[APAC] Bangladeshi authorities activated national cyber-response mechanisms after reported attacks disrupted government and financial-sector websites between 22 and 23 July, with officials treating the outages as deliberate malicious interference rather than routine technical failure. Investigators will need to correlate hosting telemetry, traffic spikes, application logs, defacement artefacts and attacker communications across multiple organisations to determine whether the activity was centrally coordinated and identify the infrastructure used to direct it (Source: Geobit, 23-07-2026).

[APAC] Australian utility Origin Energy confirmed that attackers accessed customer names, addresses, dates of birth, telephone numbers, account information and partial payment details, while an individual claiming responsibility alleged that records concerning two million customers were obtained. The investigation must establish the initial access vector, credential use, persistence period, affected repositories and exact extraction scope while reconciling company telemetry with samples supplied by the alleged attacker to journalists (Source: The Guardian Australia, 23-07-2026).

[EMEA] A reported breach of online microtask platform Paidwork exposed personal and financial information associated with more than 23 million users, creating substantial risks of identity fraud, credential attacks and targeted social engineering. Validation requires comparison of the leaked dataset with authoritative account records, examination of password-storage practices, timestamps and database structures, and identification of whether financial fields originated from Paidwork itself or connected payment-processing services (Source: Malwarebytes, 22-07-2026).

[EMEA] NHS England warned that CVE-2026-16232, a critical authentication-bypass vulnerability in exposed Check Point management servers, is being actively exploited and can provide unauthenticated attackers with full administrative privileges over security policies and configurations. Hunting should prioritise unexpected SmartConsole tokens, administrator sessions, policy changes, trusted-client configuration alterations and outbound connections from management infrastructure, particularly where the server interface was directly reachable from the internet (Source: NHS England Digital, 23-07-2026).

[AMER] Threat researchers reported active Cl0p-affiliate exploitation of internet-facing PTC Windchill and FlexPLM systems using a pre-authentication information disclosure and login-servlet weakness to achieve remote code execution, deploy JSP webshells and steal data. Detection should correlate unusual WSDL requests, servlet access, newly created JSP files, suspicious child processes and large outbound transfers because the attack chain supports both persistent access and subsequent double-extortion activity (Source: Ransomware Information Sharing and Analysis Centre, 22-07-2026).

[APAC] Singapore Police arrested a 23-year-old Malaysian man at Changi Airport and announced charges over his suspected role in a fake-friend telephone scam in which a 69-year-old victim handed over S$20,000 in cash. The rapid identification of the alleged collector indicates effective correlation of the victim’s communications, airport surveillance, travel records and physical handover evidence, while further analysis may identify the remote callers and associated financial beneficiaries (Source: Singapore Police Force, 22-07-2026).

[APAC] Timor-Leste authorities pledged stronger action against organised cybercrime following investigations that led to arrests of foreign nationals and the seizure of hundreds of computers, mobile telephones and other electronic equipment. Those devices may provide evidence of account control, victim targeting, payment routes, communications and shared infrastructure, but their evidential value will depend on coordinated acquisition procedures, translation support, device attribution and preservation of links between digital artefacts and individual suspects (Source: Tatoli, 23-07-2026).

[EMEA] The Council of the European Union adopted its twenty-first sanctions package against Russia, expanding restrictions across energy, financial services and cryptocurrency while maintaining measures addressing state-linked cyber activity. Effective enforcement will require investigators and regulated organisations to correlate wallet ownership, exchange records, beneficial ownership data, transaction histories and sanctions identifiers so that cyber-enabled revenue flows and attempts to obscure controlled assets can be documented to an evidential standard (Source: Council of the European Union, 23-07-2026).

[EMEA] The UK Government Security function updated its guidance introducing the Cyber Assessment Framework, which structures assurance around risk management, protection against attack, detection and minimisation of cyber-event impact. For investigative readiness, organisations should treat the framework’s logging, monitoring, governance and response expectations as evidence requirements, ensuring that records are sufficiently complete, time-synchronised and retained to support reconstruction of incidents and independent assessment of security-control performance (Source: UK Government Security, 23-07-2026).