Over the past 48 hours, defenders saw OT hardening guidance, fresh ICS advisories, and reports of active FortiSIEM exploitation. Hospitals and travel services faced disruptive incidents and data exposure, while investigators tracked themed malware and money-mule networks. Standards bodies advanced AI security and payment software assurance, signaling tighter audit expectations. Prioritize patching, segmentation, logging choke points, and evidence-ready reporting today.

In this 48-hour window, identity and tooling-layer risk outpaced perimeter assumptions, from mail compromise investigations to supply-chain exploitation. Responders should prioritise cloud audit evidence, CI/CD and dependency provenance, and rapid validation that mitigations actually block exploit paths. Policy signals the same direction: exploited-vulnerability governance is now auditable practice, driving vendor accountability and measurable resilience outcomes across public services and industry.

This 48-hour DFM roundup tracks global cyber risk across DFIR, investigations, major incidents, exploitation and governance. Highlights include government email compromise, large-scale consumer breach fallout, OT and Windows patch triage, and enforcement actions disrupting hostile infrastructure. The meta theme is evidence readiness: deception telemetry, standardized baselines, supplier controls and rapid remediation are now inseparable from incident response and regulatory defensibility for teams.

In this 48-hour roundup we track insider-driven mega breaches, disrupted court and logistics systems, and fresh leaks from healthcare and consumer apps. New OT and backend vulnerabilities join the KEV list, while Europol’s Cryptomixer takedown and UK ransomware-reporting plans show growing pressure on the criminal business model and on unprepared boards, demanding faster, evidence-led response and genuinely risk-based cyber governance.