This edition examines coordinated intrusions affecting Minnesota water systems, UK government data theft, anti-forensic Linux cryptomining, Cisco firewall exploitation and North Korean software supply-chain activity. It also covers ransomware affecting an Australian school, disruption at Angola’s largest telecommunications operator, cyberstalking charges, privacy enforcement and the growing evidential demands created by cross-platform digital investigations and operational technology evidence preservation practices.

CISA added five newly exploited vulnerabilities to KEV as Cisco warned more Catalyst SD-WAN flaws are under active attack. Europol seized LeakBase and disrupted Tycoon 2FA, while Passaic County reported a malware outage and LexisNexis confirmed a data breach. Google challenged geofence warrants, and draft Cyber Resilience Act guidance signalled tougher product-security expectations for vendors and defenders globally this week.

Across regions, exploit-confirmed prioritization and identity-focused monitoring remain the quickest path to cutting incident volume. Public-sector resilience programs and privacy enforcement are tightening accountability, while third-party breaches keep fueling fraud. Strengthen evidence discipline: validate mail routing, inventory edge devices, and map vendor data flows. These seams are repeatedly exploited—and increasingly interrogated by regulators and boards in the next 48 hours.