Global coverage from 05–07 Nov 2025: SonicWall attributes its breach to a state-backed actor, while the Washington Post confirms exposure via Oracle-linked software. Android’s “Landfall” spyware zero-day and Monsta FTP RCE headline new exploits. ENISA warns of DDoS waves on public services as CISA releases fresh ICS advisories and NCSC announces Mail/Web Check retirement.

The past 48 hours saw major movement across global cyber fronts, including AI-enabled backdoors, cargo-theft hacking campaigns, and high-impact data breaches in Japan and Sweden. Actively exploited WordPress and Android vulnerabilities demand immediate patching, while new CISA KEVs and ICS advisories raise urgency for OT environments. Meanwhile, Europol operations disrupted large-scale fraud and crypto-platform crime.

The NCSC Annual Review 2025 highlights a decisive year for UK cyber resilience, with record incident volumes and major strides in AI security, critical supplier oversight, and automation. Yet ransomware and supply-chain vulnerabilities persist. For DFIR professionals, the Review underscores urgency around governance accountability, rapid patching, dependency mapping, and post-quantum preparedness across critical national sectors.

Digital forensics in UK law enforcement stands at a turning point. The National Audit Office’s 2025 Police Productivity report exposes rising digital demand, fragmented governance, and critical skills shortages. This briefing analyses the findings, links them to forensic capability and reform, and outlines how national standardisation could transform police productivity and justice outcomes.

BADCANDY reinfection warnings, telecom resilience failures, and new DDoS alerts dominated the last 48 hours. The Philippines DICT warned of a possible 5 November cyberattack, while Australia’s Optus outage review exposed change-control gaps. Global DFIR teams are urged to verify router hygiene, review vendor trust chains, and monitor evolving breach-reporting rules shaping future compliance.