Cyber Security News

Hacking Editorial Brief — May 8, 2026

## ShinyHunters Targets Canvas Platform, Affects 9,000 Educational Institutions

The prolific cybercrime group ShinyHunters has claimed responsibility for breaching Instructure, the parent company of Canvas learning management system, impacting approximately 9,000 schools and universities across the United States. The attack caused widespread Canvas outages on Thursday, with institutions from Kansas State to Princeton to North Carolina state schools reporting disruptions during finals period. ShinyHunters posted ransom messages directly within Canvas systems, threatening to release "several billions of records" including student and staff names, email addresses, and student IDs if demands are not met. The group has a documented history of large-scale data breaches since 2019. Educational institutions across Missouri, Texas, Pennsylvania, and the Carolinas have confirmed impact, with some reporting that data from as early as April may have been compromised.

## Active Zero-Day Exploitation and Critical Vulnerabilities

Ivanti has disclosed CVE-2026-6973, an improper input validation vulnerability in Endpoint Manager Mobile (EPMM) currently being exploited in limited zero-day attacks. The flaw requires administrative access for exploitation but represents an active threat to enterprise mobile management infrastructure. Separately, researchers have detailed CVE-2026-31431, dubbed "Copy Fail," a critical local privilege escalation vulnerability disclosed April 29 affecting mainstream Linux distributions including Ubuntu, Red Hat, and Debian. The flaw is being characterized as one of the most severe Linux threats in years, with millions of systems potentially vulnerable. Meanwhile, three malicious packages discovered on the Python Package Index have been found delivering ZiChatBot, a previously unknown malware family that targets both Windows and Linux systems via Zulip APIs. In an unusual development, TechCrunch reports that an unknown hacker group is actively re-compromising systems previously breached by the cybercrime group TeamPCP.

Sources: K-State Collegian · WCNC · WRAL · Daily Princetonian · Bleeping Computer · Unit 42 · The Hacker News · TechCrunch