This edition examines AI coding agent supply-chain risks, the Tata Electronics investigation, RustDuck botnet expansion, SimpleHelp exploitation, major breaches affecting Aflac Japan and Nidec, BlueHammer and Oracle vulnerabilities, UK ransomware reporting trends, and evolving cybersecurity governance. The reporting highlights the growing importance of preserving provenance and evidential integrity across increasingly distributed digital investigations and cloud-based environments.

Global DFIR highlights include 34 zero-days chained at Pwn2Own Ireland and active Oracle E-Business Suite exploitation confirmed by CISA. Microsoft detailed Blob Storage attack chains, while Muji and Verisure faced major breaches. UK police secured major online abuse convictions. NIST and the EU advanced supply-chain and cybersecurity certification initiatives, signalling rising compliance expectations.

Envoy Air and Prosper breaches dominate this 48-hour cycle, alongside China’s cyber-espionage allegations against the U.S. and new F5 patches issued after a major breach. GDPR enforcement, sanctions on scam networks, and NCSC’s annual review add regulatory weight. DFIR teams face converging challenges across extortion, compliance, and state-linked threat activity.

A sweeping 48-hour snapshot reveals Oracle E-Business Suite exploitation driving global extortion, Discord’s vendor breach exposing 70,000 IDs, and new CISA KEV and ICS advisories. Law enforcement seized BreachForums’ latest domain, while Clearview AI lost a key UK tribunal case. ENISA’s 2025 threat report underscores accelerating vulnerability exploitation and ransomware persistence worldwide.

The past 48 hours saw Oracle customers targeted with extortion emails, Asahi shipments in Japan disrupted by ransomware, and CISA expanding its KEV list. DFIR teams investigated child data leaks and PHI exposures, while Dutch teens faced arrest for Europol spying. Policy updates span U.S. awareness campaigns, FCC reviews, and EU/UK compliance shifts.