DigiCert reported that it had finished auditing its US business system after unauthorised access to archived customer information, closing the last action in its public incident report. The company said retained logs and audit tables identified the account and access window, while separate certificate authority records showed that the account had performed no certificate issuance, revocation or validation actions.

Maharashtra Cyber police said they recovered suspected child sexual abuse material from a mobile phone examined in Mumbai after online monitoring led investigators to a suspect. The forensic examination is continuing to determine where the files originated, how they were downloaded and stored, and whether they were shared through online platforms or linked to other people.

Mumbai police are investigating an impersonation scam in which callers posing as Indian police and counterterrorism officers allegedly persuaded a woman to transfer around ₹1.9 crore. Investigators described a sequence spanning WhatsApp calls, instructions to use Signal and transfers to three bank accounts, with purported central bank letters used to make requests for payment appear official.

Authorities in Bogotá, Colombia, are investigating after a bomb hoax sent to a European airport appeared to come from a public hospital network in the city. A copy examined by The Record appeared to carry the network’s domain, but the available evidence leaves open whether the sender forged the address or gained access to an actual mailbox.

The company building the Brenner Base Tunnel between Austria and Italy confirmed that unauthorised parties accessed private data and said construction and operations had continued. It told ANSA that it isolated the affected systems, brought in external forensic specialists and alerted authorities, while the extent of access and the volume of data compromised remained undetermined in the account it gave ANSA.

Singapore telecommunications operator M1 disclosed a breach involving customer names, national identity or foreign identification numbers, dates of birth and contact details, saying services remained operational. The company said it had contained the breach and was working with authorities and outside specialists, while its disclosure identified the affected data categories without giving a customer count or identifying how the access occurred.

SonicWall issued a global advisory for CVE-2026-19868 after investigating a report of possible exploitation affecting the SSL VPN service on certain seventh and eighth generation firewalls. The flaw can allow someone holding valid credentials for a different login method to bypass SAML checks and potentially its multifactor authentication when SAML is enabled for VPN logins on the affected firewall.

Amazon Web Services removed a setup example from its global Trusted Remote Execution documentation after finding that it could introduce operating system command injection into customer deployments. The issue, CVE-2026-122193, affects Systems Manager documents created from the example, allowing someone already authorised to invoke such a document to pass crafted input and run commands outside the intended sandbox.

Police in East Champaran district in Bihar, India, arrested two people during a raid linked to a suspected mobile fraud scheme and seized two phones and five cash machine cards. Officers said their examination of the devices found WhatsApp messages and information about suspected illicit transactions, and they registered a case based on their enquiries.

A man was arraigned in Binghamton, New York, on charges including access device fraud and aggravated identity theft in a case involving Social Security payments to a deceased beneficiary. Federal prosecutors allege that he used an unauthorised cash machine card to make withdrawals over nearly six years and are seeking forfeiture of just under $110,000.

The UK published its statement on the London conference of the Global Cybersecurity Labelling Initiative, welcoming the European Union as a member and Japan as the next host. The initiative is working towards greater compatibility between security labels and standards for connected devices, and the meeting included industry input on putting those requirements and schemes into practice.

Japan adopted an emergency cybersecurity package that calls for stronger public and private sector information sharing, better investigative capacity and greater use of artificial intelligence to find vulnerabilities. The package sets out plans for a specialist testing team and earlier assessments of government systems, alongside measures to reduce the amount of personal information held by organisations.