CISA's calls for a JCDC makeover.

This CyberWire digest summarizes several active security events: Snowflake reported an account compromise targeting users without MFA and related data theft (Advance Auto Parts data surfaced for sale); the FBI published LockBit decryption keys for victims; a V3B phishing-as-a-service toolkit is targeting banking customers; Trend Micro details the Commando Cat cryptojacking campaign abusing exposed Docker Remote APIs; attackers accessed a Disney Confluence server and exfiltrated ~2.5GB of Club Penguin-related data; and a long-standing Oracle WebLogic vulnerability is being actively exploited—collectively highlighting credential hygiene, exposed services, phishing, and active exploitation risks.