University data breaches, long-term espionage activity, banking disruptions, critical enterprise vulnerabilities and major law-enforcement operations feature in this 48-hour roundup. Coverage includes the Nottingham University breach, PeopleSoft zero-day exploitation, cyberattacks affecting Iranian banks, active Splunk and Ivanti security risks, FBI-led disruption of phishing infrastructure, and new policy measures aimed at accelerating cyber resilience and evidence preservation.

Canvas breach investigations affecting universities, ransomware disruption at West Pharmaceutical and Foxconn, active exploitation of a critical cPanel vulnerability, and Europol’s latest cybercrime assessment headline this 48-hour roundup. Coverage also examines AI-assisted exploitation, leaked ransomware operator data, industrial control system security advisories, and evolving policy guidance on cyber resilience and frontier artificial intelligence.

Australian police exposed Cambodian scam scripts, Meta alleged renewed NSO-linked targeting, and investigators tracked cloud-theft and payment-skimming campaigns. A supply-chain worm hit npm packages, critical flaws affected Gogs and UniFi systems, and multinational enforcement actions disrupted scam infrastructure. Policy developments included European technology sovereignty initiatives and updated cloud-security guidance influencing evidence preservation and cross-border investigations.

Education-sector cyber incidents, software supply-chain compromises and actively exploited mobile vulnerabilities dominated this reporting period. Reported attacks affecting Indian examination platforms, malicious npm package activity and Android security flaws drew significant attention. Regulators in Hong Kong, Europe and the United States also advanced AI-related cybersecurity measures, while Europol and U.S. policymakers highlighted evolving cybercrime enforcement and investigative capabilities.

Investigators tracked a FIFA-themed fraud network, examined a law firm’s Microsoft 365 breach, and followed prosecutions tied to stolen government access. Major disclosures affected telecom and travel customers, while researchers documented FortiClient exploitation and The Gentlemen ransomware. Singapore warned about AI agent risks, ENISA assessed NIS2 sector maturity, and Dutch police arrested a suspect linked to the Ajax data breach.