DFM’s 48-hour global roundup tracks active exploitation and high-impact breaches, alongside enforcement and policy moves shaping response obligations. Key themes include appliance-level compromise requiring rebuild decisions, KEV-driven patch acceleration, and major consumer data incidents escalating into multi-agency scrutiny. Investigations emphasize the money layer—mule accounts and laundering hubs—while standards and governance pressures continue to tighten auditability, reporting, and defensible security operations across regions.

In the last 48 hours, breaches and recoveries hit healthcare and retail, while investigators disrupted fraud marketplaces and laundering services. Major incidents affected oil logistics and UK government systems. Active exploitation warnings targeted React2Shell and SonicWall SMA, alongside new CISA ICS advisories. Policy and standards moved on UK cyber legislation, EU CRA reporting, and NIST’s Cyber AI profile this week.

Global coverage from 05–07 Nov 2025: SonicWall attributes its breach to a state-backed actor, while the Washington Post confirms exposure via Oracle-linked software. Android’s “Landfall” spyware zero-day and Monsta FTP RCE headline new exploits. ENISA warns of DDoS waves on public services as CISA releases fresh ICS advisories and NCSC announces Mail/Web Check retirement.

Ransomware, data leaks, and zero-days dominated the past 48 hours. Qantas confirmed customer data was posted online, while Texas officials battled a municipal network breach. Healthcare ransomware rose 30%, and Apple doubled its top bug bounty. Germany’s rejection of EU “chat control” rules underscores encryption’s central role as DFIR teams confront escalating third-party and exploit risks.

Ransomware disrupted Sweden’s municipal IT and Pennsylvania’s Attorney General’s office, while attackers abused Velociraptor and VS Code tunnels for stealthy access. New threats include WhatsApp zero-click exploits, TamperedChef malvertising, Brokewell Android malware, and ScarCruft’s RokRAT espionage. Indian police dismantled trafficking-to-scam pipelines and online fraud rings, underscoring cybercrime’s human dimension alongside technical threats.