The latest 48 hours saw coordinated attacks on London councils, a breach at Harvard, and ransomware disrupting US emergency alerts. Industrial firm Balkrishna Paper Mills and major banking vendor SitusAMC also reported compromises. Active exploitation of a FortiWeb zero-day, a revived npm worm campaign, and a huge Android fiction-app data leak round out a high-impact period.

The past 48 hours saw major activity across DFIR, investigations and global threat intelligence, with ransomware playbooks, supply-chain breaches and identity-system zero-days dominating the landscape. Law-enforcement operations intensified across Asia, while G7 nations advanced cyber-policy coordination. Key updates highlight the growing convergence of identity, vendor ecosystems and human factors as critical security priorities.

The first fully autonomous AI-driven cyber-espionage campaign marks a turning point in national-level cyber operations. Anthropic’s investigation into the state-aligned GTG-1002 group reveals how AI executed up to 90% of the intrusion lifecycle—reconnaissance, exploitation, lateral movement, and data theft—at machine speed. DFIR teams now face a new era of AI-orchestrated, high-velocity attacks.

Global DFIR teams face cascading fallout from an Oracle EBS zero-day campaign, SaaS and VPN breaches, and side-channel attacks on AI models. UK resilience legislation, sanctions Amber Alerts and NIST’s CSF 2.0 profile reshape compliance expectations. Law enforcement pushes back on crypto fraud and DPRK IT-worker schemes, while police expand digital forensics capacity, demanding sharper playbooks and faster incident reporting.

The latest 48-hour global cybersecurity roundup covers ongoing fallout from Oracle E-Business Suite exploitation, new Microsoft Patch Tuesday detections, CISA’s KEV update, and the UK’s proposed Cyber Security and Resilience Bill. It highlights data-breach disclosures, evolving policy frameworks, and cross-sector responses that matter most to DFIR and cyber-risk professionals worldwide.