Over the past 48 hours, DFIR teams faced active Cisco zero-day exploitation, evolving macOS XCSSET tactics, and BRICKSTORM espionage. Aviation operations suffered vendor software disruption; Harrods reported a third-party breach. INTERPOL announced 260 arrests targeting sextortion scams, and the NCA detained a UK suspect. CISA issued an emergency directive; NIST published compliance updates. Organisations should prioritise patching and secure-boot verification.

Supply-chain breaches dominate the window: Jaguar Land Rover confirms a data compromise and UK rail operator LNER warns customers after a supplier attack. CISA adds an actively exploited DELMIA Apriso flaw to KEV. Europol names a suspected ransomware admin Most Wanted. Policy shifts include EU Data Act switching duties and US debate over reauthorizing CISA 2015 before September 30 sunset.

DFIR & Incident Response Elastic: How to reduce alert overload in defence SOCs (2025-08-22, EMEA). Guidance focuses on AI-powered triage […]

🔍 Digital Forensics & Incident Response Citizen Lab reveals VPN app flaws across multiple Android tools: Shared code and poor […]

🔍 Digital Forensics & Incident Response Citizen Lab reveals widespread VPN app security flaws: Nearly two dozen Android VPN apps […]