Ransomware disrupted University of Mississippi Medical Center clinics while Japan’s Advantest investigated a network intrusion. CISA warned BeyondTrust CVE-2026-1731 is exploited in ransomware, and a critical Grandstream VoIP flaw enables root RCE. PayPal reported customer-data exposure from an application error, and an Android AI media editor leaked millions of files, alongside indictments for ATM jackpotting.

China-linked actors exploited a Dell RecoverPoint zero-day for 18 months, while CISA added an actively exploited Chrome flaw to its KEV catalog. Australia’s YouX faced a major data-leak claim, and passport scans from Abu Dhabi Finance Week were exposed via a vendor server. Police arrested a Phobos ransomware suspect in Poland, as the UK launched a business cyber-hygiene campaign nationwide.

Nike investigated an extortion-linked breach claim, Rotterdam port operations faced hacktivist-driven DDoS disruption, and CISA added actively exploited Ivanti EPMM vulnerabilities to its KEV catalogue. Law enforcement seized the RAMP cybercrime forum, while NIST advanced its Cyber AI Profile consultation. Identity compromise, control-plane abuse, and data-only extortion dominated incident response priorities globally.

In this 48-hour window, identity and tooling-layer risk outpaced perimeter assumptions, from mail compromise investigations to supply-chain exploitation. Responders should prioritise cloud audit evidence, CI/CD and dependency provenance, and rapid validation that mitigations actually block exploit paths. Policy signals the same direction: exploited-vulnerability governance is now auditable practice, driving vendor accountability and measurable resilience outcomes across public services and industry.

Digital Forensics Magazine’s 48-hour cybersecurity roundup tracks the latest DFIR and investigation priorities, including ransomware recovery lessons, vendor-driven airline exposure, and consumer healthcare breach updates. We cover active exploit warnings (IBM API Connect auth bypass and MongoBleed risk), law-enforcement actions against ransomware affiliates and ATM malware crews, and fast-moving APAC and EU policy and compliance deadlines shaping 2026 incident response readiness.