Grafana confirmed a breach after cybercriminal exposure claims, while researchers tracked Telegram-based iPhone unlocking services tied to stolen devices. Investigators also examined active exploitation of a critical NGINX vulnerability, cloned Shai-Hulud malware campaigns and INTERPOL’s Operation Ramz arrests across the MENA region. Policy discussions focused on AI-assisted vulnerability discovery and regulatory expectations surrounding automated cyber risk analysis in financial sectors.

OpenAI rotated certificates after the TanStack npm supply-chain compromise, while Foxconn resumed operations following a ransomware incident claimed by Nitrogen. Cisco warned of active exploitation against critical SD-WAN infrastructure, and investigators examined breaches affecting Canvas and Nvidia GeForce NOW partners UK cyber sector analysis and ENISA CVE authority expansion highlighted dependence on evidence handling, vulnerability governance and investigative capability globally.

Canvas exposure disclosures, Trellix repository access, Gujarat cyber-fraud arrests and Australian cryptocurrency seizures dominated this 48-hour investigations cycle. U.S. prosecutors secured sentencing against a ransomware negotiator linked to multimillion-dollar extortion operations, while CISA expanded its exploited vulnerability catalog and the UK NCSC warned organisations to prepare for faster AI-driven vulnerability discovery and patching pressures across critical digital environments worldwide systems.

Europol fraud and Black Axe actions, Signal phishing targeting German officials, Singapore contractor data exposure, Winona County ransomware leaks, Itron and Medtronic network intrusions, active cPanel exploitation, malicious SAP npm packages, UK breach survey findings, and agentic AI security guidance shape this DFM 48-hour roundup for investigators focused on evidence, attribution, audit trails, and cross-platform correlation readiness.

French identity services faced potential data exposure, while New South Wales investigated unauthorised transfers of confidential Treasury files. Ukrainian police dismantled a Telegram bot farm supporting disinformation campaigns, and U.S. prosecutors secured guilty pleas in ransomware and phishing cases. Meanwhile, new .NET vulnerabilities and serial-to-IP device flaws highlighted ongoing exposure risks across connected infrastructure environments.