Cisco patched a Unified Communications RCE (CVE-2026-20045) amid active exploitation, while CSA Singapore urged urgent updates. CISA issued a batch of ICS advisories for OT operators. Investigators tracked the Telegram-linked Tudou Guarantee marketplace and authorities tied suspects to Black Basta. Policy moved on Ireland’s spyware law, EU high-risk vendor phase-out, and UK NIS Bill progress. Chainlit flaws threatened cloud apps.

Over the past 48 hours, responders tracked UK warnings on Russia-aligned DDoS activity, Ingram Micro’s disclosure affecting 42,000 people, and a brief hijack of Iranian state television feeds. Investigations detailed LinkedIn-delivered malware and Gemini prompt injection, while policymakers advanced EU cybersecurity reforms, new UK fraud reporting, and Singapore issued fresh vulnerability advisories impacting cloud deployments, broadcast resilience, and response planning.

Under rapid patch pressure, defenders are juggling exploited flaws in common enterprise and developer services while real-world disruption hits hospitals, utilities, and large consumer platforms. The practical priority is sequencing: isolate exposed edge systems, validate logs and backups, then patch and hunt for pre-fix exploitation artifacts. Intelligence signals also show more “trusted channel” lures via messaging apps, expanding monitoring beyond email.

Ransomware, supply-chain breaches and zero-day exploits dominate this 48-hour DFIR roundup. Hospitals, telecoms and e-commerce platforms face data theft, while regulators tighten data-sovereignty and patching expectations in Europe and India. New Windows and React vulnerabilities, AT&T’s dark web fallout and fresh law-enforcement advisories underscore why robust logging, rapid patching and vendor risk management remain non-negotiable for security and leadership teams.

Over the past 48 hours, DFIR teams have faced escalating ransomware, supply-chain breaches and state-backed backdoors, while regulators and law enforcement push back with major takedowns and new AI-OT guidance. From European crypto-fraud raids to Asia-Pacific “digital arrest” scams and North American data leaks, the roundup tracks evolving attacker playbooks and practical defensive priorities for security leaders and incident responders.