Canvas breach negotiations, Foxconn ransomware disruption, malicious RubyGems packages and Microsoft’s May patch cycle dominated the latest Digital Forensics Magazine roundup. Investigators also tracked prolonged compromise exposure at a UK water provider, regulatory findings affecting Dutch healthcare security practices, and FTC guidance following education-sector data theft claims. The reporting highlights pressure on evidence preservation, attribution accuracy and cross-platform investigative coordination.

Intuitive disclosed a phishing-linked breach of internal business applications, CISA added a Wing FTP flaw to its exploited catalog, and investigators traced GlassWorm fallout into compromised GitHub-hosted Python repositories. INTERPOL warned that AI-enhanced financial fraud is scaling globally, while NIST advanced cryptographic validation automation and the UK ICO pressed technology firms to strengthen age checks and protect children’s data better.

UK NCSC urged organisations to tighten monitoring amid Middle East spillover risks, while Cloudflare reported session-token abuse. AkzoNobel confirmed a breach at a U.S. site after an extortion leak claim, and Russian government portals suffered a multi-vector DDoS. CISA warned VMware Aria Operations is being exploited, and California’s privacy regulator fined PlayOn Sports $1.1M. Supreme Court heard geofence warrant challenge.

Ransomware disrupted University of Mississippi Medical Center clinics while Japan’s Advantest investigated a network intrusion. CISA warned BeyondTrust CVE-2026-1731 is exploited in ransomware, and a critical Grandstream VoIP flaw enables root RCE. PayPal reported customer-data exposure from an application error, and an Android AI media editor leaked millions of files, alongside indictments for ATM jackpotting.

China-linked actors exploited a Dell RecoverPoint zero-day for 18 months, while CISA added an actively exploited Chrome flaw to its KEV catalog. Australia’s YouX faced a major data-leak claim, and passport scans from Abu Dhabi Finance Week were exposed via a vendor server. Police arrested a Phobos ransomware suspect in Poland, as the UK launched a business cyber-hygiene campaign nationwide.