This edition examines investigations into AI containment failures, browser extension exposure, Russian Zimbra espionage and attacks on government systems. It also covers major data breaches affecting Origin Energy and Paidwork, active exploitation of Check Point and PTC vulnerabilities, cybercrime arrests across Asia-Pacific, and new European sanctions and UK assurance guidance shaping investigative readiness, evidence preservation and attribution across affected organisations.

Ransomware, supply-chain breaches and zero-day exploits dominate this 48-hour DFIR roundup. Hospitals, telecoms and e-commerce platforms face data theft, while regulators tighten data-sovereignty and patching expectations in Europe and India. New Windows and React vulnerabilities, AT&T’s dark web fallout and fresh law-enforcement advisories underscore why robust logging, rapid patching and vendor risk management remain non-negotiable for security and leadership teams.

Over the past 48 hours, DFIR teams have faced escalating ransomware, supply-chain breaches and state-backed backdoors, while regulators and law enforcement push back with major takedowns and new AI-OT guidance. From European crypto-fraud raids to Asia-Pacific “digital arrest” scams and North American data leaks, the roundup tracks evolving attacker playbooks and practical defensive priorities for security leaders and incident responders.

In this 48-hour roundup we track insider-driven mega breaches, disrupted court and logistics systems, and fresh leaks from healthcare and consumer apps. New OT and backend vulnerabilities join the KEV list, while Europol’s Cryptomixer takedown and UK ransomware-reporting plans show growing pressure on the criminal business model and on unprepared boards, demanding faster, evidence-led response and genuinely risk-based cyber governance.