Over the past 48 hours, CISA added four exploited vulnerabilities to the KEV catalog and issued an ICS advisory on Siemens SINEC NMS. Odido confirmed a customer data leak, while SmarterTools disclosed ransomware after an auth-bypass on an unpatched VM. Researchers flagged active exploitation of a critical BeyondTrust RCE and reported nation-state use of Google Gemini for campaigns this week.

Digital Forensics Magazine’s latest 48-hour roundup tracks active exploitation alerts, significant breach disclosures, and enforcement actions shaping DFIR priorities. Highlights include ESA’s confirmed breach investigation, supplier-linked Oracle EBS impacts affecting aviation, and renewed attention on MongoDB and legacy edge weaknesses. We also cover kernel-mode APT tradecraft, supply-chain infostealer delivery, and the growing policy pressures from insurance and governance expectations.

Global DFIR highlights include 34 zero-days chained at Pwn2Own Ireland and active Oracle E-Business Suite exploitation confirmed by CISA. Microsoft detailed Blob Storage attack chains, while Muji and Verisure faced major breaches. UK police secured major online abuse convictions. NIST and the EU advanced supply-chain and cybersecurity certification initiatives, signalling rising compliance expectations.