F5 BIG-IP exploitation escalated after a flaw was reclassified to critical RCE, while a Fortinet FortiClient EMS bug also came under active attack. The European Commission confirmed a data breach after the Europa web platform incident, and UK sanctions targeted infrastructure tied to Cambodia-based scam operations. NCA’s 2026 assessment also linked cybercrime more closely with wider organised offending patterns overall.