CISA expands its Known Exploited Vulnerabilities list as Microsoft investigates active GoAnywhere MFT attacks. Japan’s Asahi Group faces a ransomware claim, while UK police arrest teens behind the Kido Nurseries breach. New NCSC guidance urges observability and proactive threat hunting. Global DFIR teams should prioritise patching, token hygiene, and compliance readiness amid rising cross-sector intrusions.

Oracle E-Business Suite zero-day (CVE-2025-61882) is being actively exploited, prompting global CERT advisories and extortion attempts linked to Clop. Asahi resumes operations after a ransomware-driven week-long outage. CISA adds a Meteobridge flaw to KEV. Europol spotlights cross-border data access gaps, while ETSI and ISO open security conferences shaping future compliance standards.