Over the past 48 hours, DFIR teams faced active Cisco zero-day exploitation, evolving macOS XCSSET tactics, and BRICKSTORM espionage. Aviation operations suffered vendor software disruption; Harrods reported a third-party breach. INTERPOL announced 260 arrests targeting sextortion scams, and the NCA detained a UK suspect. CISA issued an emergency directive; NIST published compliance updates. Organisations should prioritise patching and secure-boot verification.

Supply-chain breaches dominate the window: Jaguar Land Rover confirms a data compromise and UK rail operator LNER warns customers after a supplier attack. CISA adds an actively exploited DELMIA Apriso flaw to KEV. Europol names a suspected ransomware admin Most Wanted. Policy shifts include EU Data Act switching duties and US debate over reauthorizing CISA 2015 before September 30 sunset.

In the past 48 hours, defenders juggled Plex breach fallout, Microsoft’s Patch Tuesday triage, and npm supply-chain hijacks. Adobe Commerce shipped critical fixes, while healthcare and media breaches broadened impact. U.S. prosecutors charged a multi-ransomware administrator and posted rewards. Takeaways: accelerate credential resets, lock down publish keys, and run disciplined emergency patch cycles. Prioritize monitoring, SBOM mapping, and phishing verification.

DFIR & Incident Response Elastic: How to reduce alert overload in defence SOCs (2025-08-22, EMEA). Guidance focuses on AI-powered triage […]

🔍 Digital Forensics & Incident Response Citizen Lab reveals VPN app flaws across multiple Android tools: Shared code and poor […]