CISA updated hunting guidance for RESURGE malware lingering on Ivanti appliances, while Juniper warned of a critical PTX router takeover flaw. Reuters tracked cyber operations hitting Iranian apps and sites after strikes, as Sophos monitored Iran-linked hacktivist claims. In the US, UH Cancer Center reported SSN exposure affecting up to 1.15 million people. Substack disclosed stolen emails and phone numbers.

Ransomware, supply-chain breaches and zero-day exploits dominate this 48-hour DFIR roundup. Hospitals, telecoms and e-commerce platforms face data theft, while regulators tighten data-sovereignty and patching expectations in Europe and India. New Windows and React vulnerabilities, AT&T’s dark web fallout and fresh law-enforcement advisories underscore why robust logging, rapid patching and vendor risk management remain non-negotiable for security and leadership teams.