This 48-hour roundup covers FIRESTARTER on a Cisco ASA device, Signal phishing targeting German politicians, GopherWhisper activity against government targets, ADT and Medtronic data incidents, Breeze Cache exploitation, CISA KEV additions, Singapore and Telangana cybercrime arrests, and Cyber Essentials Danzell transition guidance, with emphasis on evidence integrity, platform records, vulnerability exposure, and cross-border investigative readiness.

Microsoft fixed an exploited SharePoint zero-day among 165 flaws, Adobe patched critical Acrobat bugs, and Basic-Fit disclosed a breach affecting about one million members. Investigators traced mailbox compromises hitting Ukrainian prosecutors, while authorities froze stolen cryptocurrency in Operation Atlantic. Regulators and central bankers also escalated scrutiny of Anthropic’s Claude Mythos Preview and its cybersecurity implications for financial stability and resilience.

CISA flagged active exploitation of a Langflow flaw, while researchers warned ShareFile bugs can deliver unauthenticated remote code execution. Mercor confirmed fallout from the LiteLLM supply-chain compromise, Hasbro investigated unauthorized network access, and CERT-EU widened the scope of the Europa platform breach. Policy and standards developments also moved, from China’s digital-human draft rules to ENISA’s digital wallet certification work effort.

F5 BIG-IP exploitation escalated after a flaw was reclassified to critical RCE, while a Fortinet FortiClient EMS bug also came under active attack. The European Commission confirmed a data breach after the Europa web platform incident, and UK sanctions targeted infrastructure tied to Cambodia-based scam operations. NCA’s 2026 assessment also linked cybercrime more closely with wider organised offending patterns overall.

From Trivy’s supply-chain compromise and Citrix’s new NetScaler memory leak to Mazda’s Thailand breach, Stryker’s recovery update, and US sentencing tied to ransomware access brokering, this DFM roundup tracks incidents, investigations, enforcement, and policy shifts. It also covers NIST’s CSF 2.0 workforce guide, a DevSecOps draft, and Treasury’s cyber insurance review alongside Crunchyroll and Infinite Campus breach disclosures this week.