Canvas Extortion, Active Zero-Days, And Cloud Updates

A widespread outage at a major learning platform collided with active exploitation of enterprise firewalls and new Linux privilege-escalation techniques, while security agencies issued accelerated patch directives. In parallel, supply-chain compromises and credential-theft malware underscored persistent operational risks, and cloud providers rolled out platform changes aimed at performance and resilience. Organizations face immediate triage on exposed systems alongside longer-term hardening across endpoints, CI/CD, and distribution pipelines.

Extortion at Scale Hits Education Platforms

Canvas was taken offline after the ShinyHunters extortion group defaced login pages with ransom demands and claimed data on an estimated 275 million students and faculty across nearly 9,000 institutions. Instructure acknowledged a breach, saying compromised information includes names, email addresses, student ID numbers, and user messages, with no evidence of exposed passwords, dates of birth, government identifiers, or financial data. The service was disabled and presented a maintenance notice during a critical exam period, while ShinyHunters extended an initial May 6 deadline to May 12 and urged institutions to negotiate directly. Researchers linked the incident to a months‑long campaign, citing earlier activity and indications of a May 1 event preceding a May 7 recompromise; common access paths for the group reportedly include voice phishing, social engineering, and compromised single‑sign‑on accounts. The breach presents immediate operational disruption and long‑term data‑exposure risks for schools, amid debate over centralized versus institution‑by‑institution response strategies.

Actively Exploited and High-Impact Vulnerabilities

Palo Alto disclosed CVE-2026-0300, a critical zero‑day in the PAN‑OS User‑ID Authentication Portal (Captive Portal) enabling unauthenticated remote code execution with root privileges on PA and VM series firewalls. Exploitation has been observed in the wild for weeks, with internet scans showing thousands of exposed VM firewalls. Security updates are expected to begin rolling out May 13; until then, the vendor advises restricting or disabling the Authentication Portal, isolating exposed devices, tightening access (management networks, VPNs, ACLs), enhancing monitoring, and preparing for rapid patching and segmentation to limit post‑exploitation movement.

Dirty Frag, a newly disclosed Linux local privilege escalation, is being used post‑compromise to gain root by abusing kernel components including esp4, esp6 (CVE-2026-43284), and rxrpc (CVE-2026-43500). Microsoft reports multiple attack paths and high reliability once local execution is obtained (for example, via compromised SSH, web shells, or container escapes). Interim mitigations include blocklisting and unloading the affected modules where possible, restricting local shell access, hardening containers, increasing escalation monitoring, and prioritizing vendor kernel patches to fully remediate risk.

Ollama is affected by CVE-2026-7482 (“Bleeding Llama”), an out‑of‑bounds heap read in the GGUF model loader triggered via /api/create. Remote, unauthenticated attackers can upload crafted GGUF files to leak process memory and exfiltrate secrets by pushing resulting artifacts via /api/push, potentially exposing environment variables, API keys, prompts, and conversation data. Researchers also highlight two Windows update issues enabling persistence when combined with auto‑update behavior. Recommended actions include applying fixes, restricting network exposure, placing gateways or auth proxies in front of APIs, auditing internet‑facing instances, and disabling or hardening client auto‑update mechanisms.

Ivanti EPMM released patches for five on‑premises vulnerabilities, with CVE-2026-6973 reported in active exploitation and added to CISA’s KEV. The issues span input validation (possible RCE), certificate validation weaknesses (impersonation/unauthorized enrollment), and access control flaws. Fixes are available for supported releases; Sentry is not inherently vulnerable but must be aligned to specific versions if new servers are added post‑patch. Because exploitation of at least one issue required administrative credentials, organizations are urged to patch immediately, rotate credentials, verify enrollment settings, and reassess the role of legacy on‑prem MDM in zero‑trust strategies.

CISA directed federal agencies to patch CVE-2026-6973 within four days, noting limited exploitation at disclosure and listing fixed EPMM versions 12.6.1.1, 12.7.0.1, and 12.8.0.1. Agencies are advised to audit admin accounts and rotate credentials; external scans have identified hundreds of internet‑exposed EPMM appliances, emphasizing the urgency of remediation and exposure review.

vm2 sandbox advisories document 13 critical flaws, including CVE-2026-26956, a full escape enabling arbitrary command execution from within VM.run() under specific Node.js 25 builds with WebAssembly exception handling and JSTag, and CVE-2026-44007, an access‑control issue affecting NodeVM with nesting:true and the legacy resolver. Teams should upgrade to vm2 3.11.2, avoid Node 25 where applicable, disable WebAssembly in sandboxes, and consider stronger isolation such as containers or V8 Isolates for untrusted code execution.

CISA KEV added CVE-2026-42208, a SQL injection in BerriAI LiteLLM, after evidence of active exploitation. Under BOD 22‑01, FCEB agencies must remediate by set deadlines; CISA recommends all organizations inventory affected instances, apply vendor patches or mitigations, implement compensating controls (for example, input validation and WAF rules), increase monitoring for anomalous queries, and document response actions.

Supply Chain, Credential Theft, and Enforcement

JDownloader’s website was compromised, swapping select download links on May 6–7 to deliver trojanized installers. The Windows alternative installer dropped a Python‑based RAT via a loader, while the Linux shell installer fetched disguised payloads, set a SUID‑root binary, and established persistence. Developers attribute the breach to a CMS vulnerability impacting published pages rather than host‑level control. The site was taken offline and guidance issued to verify signatures from AppWork GmbH; affected systems should be treated as compromised, reimaged, and have credentials rotated.

Quasar RAT (Linux) targets developers and DevOps environments to harvest secrets from tooling and cloud configurations, deploys redundant persistence and dual‑layer concealment (LD_PRELOAD and eBPF), and captures authentication data via PAM hooks. Its command set spans shell execution, file/process control, tunneling, and exfiltration over multiple transports, with potential downstream impact on registries, CI/CD pipelines, and cloud resources. Recommended defenses center on credential hygiene, MFA, monitoring for anomalous authentication and persistence artifacts, and hardening developer workstations and build agents.

Contractor case: After termination in February 2025, a former federal contractor was convicted for conspiring to destroy government databases—approximately 96 across multiple agencies—by placing datasets in write‑protect mode and deleting them, then attempting to conceal activity (including seeking AI guidance on log clearing). Charges include destruction of records, aggravated identity theft, computer fraud, and theft of government information; sentencing is scheduled for September 9, 2026. The episode highlights insider risk, vetting gaps, and the misuse of generative tools in cover‑ups.

Crimenetwork’s rebooted marketplace was dismantled by German and Spanish authorities, with an alleged administrator arrested in Mallorca. Investigators cite at least €3.6 million in revenue and seized assets and records, continuing a trend of cross‑border operations targeting darknet markets and enabling follow‑on prosecutions of vendors and users.

Cloud and Platform Updates

GKE introduced infrastructure‑level changes that deliver up to 4× faster node startup for qualifying Autopilot workloads, including select GPU families. The redesign combines intelligent compute buffers, fast‑starting VMs, and control‑plane updates that allow instant VM resizing, reducing cold‑start latency without customer configuration changes. Benefits include more responsive autoscaling, lower need for idle capacity, and improved cost efficiency for bursty inference and batch jobs.

Gemini CLI debuted as an AI‑assisted CI/CD extension that automates containerization, deployment to Cloud Run or Cloud Storage, and pipeline generation via specialized skills and a Go‑based MCP server. Operating under Application Default Credentials, it provisions artifacts and IAM, generates cloudbuild.yaml and triggers, and returns public endpoints. The post advises least‑privilege configurations for credentials and service accounts used by generated pipelines.

Route 53 Global Resolver now supports adding and removing AWS Regions for anycast DNS resolution, enabling finer control over where queries are served to address latency and data‑residency needs. The capability aims to simplify traffic engineering and compliance without re‑creating resolver setups and is available at no additional cost in supported Regions.

Fortinet introduced the FortiExtender WAN 50G, a 5G gateway designed to extend WAN connectivity for FortiGate firewalls at distributed sites. With dual 5GE ports, internal antennas for constrained environments, out‑of‑band management, VRRP support, and telemetry integrated into FortiAIOps, the appliance targets resilient wireless backhaul, centralized management, and faster recovery across large fleets.