Global DFIR teams face cascading fallout from an Oracle EBS zero-day campaign, SaaS and VPN breaches, and side-channel attacks on AI models. UK resilience legislation, sanctions Amber Alerts and NIST’s CSF 2.0 profile reshape compliance expectations. Law enforcement pushes back on crypto fraud and DPRK IT-worker schemes, while police expand digital forensics capacity, demanding sharper playbooks and faster incident reporting.

The latest 48-hour global cybersecurity roundup covers ongoing fallout from Oracle E-Business Suite exploitation, new Microsoft Patch Tuesday detections, CISA’s KEV update, and the UK’s proposed Cyber Security and Resilience Bill. It highlights data-breach disclosures, evolving policy frameworks, and cross-sector responses that matter most to DFIR and cyber-risk professionals worldwide.

The past 48 hours saw major movement across global cyber fronts, including AI-enabled backdoors, cargo-theft hacking campaigns, and high-impact data breaches in Japan and Sweden. Actively exploited WordPress and Android vulnerabilities demand immediate patching, while new CISA KEVs and ICS advisories raise urgency for OT environments. Meanwhile, Europol operations disrupted large-scale fraud and crypto-platform crime.

ACSC and CISA released synchronized Exchange Server hardening guidance as new KEV entries and ICS advisories highlight active exploitation across IT and OT systems. Major incidents hit Ribbon Communications and Conduent, while U.S. prosecutions target Conti and insider espionage cases. DFIR teams should prioritize patch validation, supplier risk reviews, and Exchange baseline enforcement.