Investigators tracked ShinyHunters-linked franchise data theft affecting 7-Eleven systems while French authorities expanded BreachForums attribution efforts. Telecom espionage activity using the Showboat Linux backdoor targeted Central Asian providers, and Europol dismantled the criminal First VPN service. Microsoft addressed actively exploited Defender vulnerabilities as NIST advanced manufacturing recovery guidance and software supply-chain assurance discussions for public and private sector investigators globally.

Investigators tracked deepfake risks in UK councils, cloud-based exfiltration through Cloudflare endpoints, and alleged cyber-slavery recruitment tied to Cambodian scam compounds. GitHub confirmed repository exposure after a poisoned package compromise, while NIST advanced software provenance guidance and UK authorities expanded financial tracing against livestreamed child exploitation networks. Education-sector breach claims and AI-driven vulnerability research further shaped this reporting cycle globally.

Backdoored WordPress plugin updates created unauthorised access across production sites, while investigators examined coordinated campaigns targeting enterprise messaging infrastructure and exposed administrative tooling. Enforcement activity linked to DDoS-for-hire disruption operations and regulatory developments around AI and crypto governance further illustrated how technical compromise, investigative response, and policy intervention continue to converge across operational security environments.

This 48-hour roundup covers FIRESTARTER on a Cisco ASA device, Signal phishing targeting German politicians, GopherWhisper activity against government targets, ADT and Medtronic data incidents, Breeze Cache exploitation, CISA KEV additions, Singapore and Telangana cybercrime arrests, and Cyber Essentials Danzell transition guidance, with emphasis on evidence integrity, platform records, vulnerability exposure, and cross-border investigative readiness.