Cyber Security News

Hacking Brief – May 13, 2026

Canvas Breach Resolved Through Ransom Payment

Instructure, the parent company of the widely-used Canvas learning management system, confirmed it reached an agreement with the ShinyHunters threat actor group to delete 3.65TB of stolen data affecting nearly 9,000 educational institutions worldwide. The ransomware attack, which disrupted final exams at universities including the University of Illinois, compromised student ID numbers, email addresses, names, and private Canvas messages belonging to approximately 275 million individuals. ShinyHunters had threatened to publicly dump the data unless a ransom was paid. The attack temporarily forced Canvas offline during a critical period for academic institutions, with some universities forced to reschedule finals. The incident highlights persistent vulnerabilities in the education technology sector.

Google Reports First AI-Assisted Zero-Day Discovery

Google's Threat Intelligence Group announced the detection of what appears to be the first known case of threat actors using artificial intelligence to discover and weaponize a zero-day vulnerability. The exploit targeted two-factor authentication bypass mechanisms, and Google assesses it likely prevented what could have been a "mass exploitation event." This marks a significant milestone in offensive security capabilities, confirming long-standing concerns about AI-accelerated vulnerability research. Separately, Iran-linked threat actor Seedworm was observed in a global espionage campaign that breached a Korean electronics manufacturer, using DLL sideloading with signed Fortemedia and SentinelOne binaries for persistence and data exfiltration. Additionally, a pro-Iran hacking group launched attacks against San Jose-based eBay, while ransomware operations continued to target industrial infrastructure, with West Pharmaceutical Services and Foxconn's North American factories both confirming disruptive attacks.

Sources: Long Beach Post · SMH · The Hacker News · CNBC · Security.com · Yahoo · SecurityWeek · 9to5Mac