Instructure Canvas LMS — used by K-12 and higher-ed for coursework, grading, and SSO.
Discourse (Canvas) patched a critical image upload vulnerability chain affecting file disclosure. The flaw combined JPEG processing delays, Ghostscript execution, and ImageMagick SVG parsing to read arbitrary server files from any Trust Level 0 account. A separate cache poisoning vulnerability allowed JavaScript execution to anonymous visitors. Both issues were patched in June 2026 before disclosure; CVE-2026-55420 covers the image pipeline flaw affecting default configurations.
Canvas (Discourse) image upload functionality was vulnerable to remote code execution through malformed HEIF image files via the libheif dependency. The vulnerability involved integer overflow edge cases in the overlay composition function, with at least three distinct bugs (including CVE-2026-32882) exploited by the Hacktron threat group to compromise systems, including OpenAI's internal infrastructure. The exploit chain traced to a May 2025 fix in libheif that was not flagged as security-relevant and failed to reach stable Debian distributions Canvas deployments relied upon.
CVE-2026-90860 is a high-severity vulnerability (CVSS 7.1) in Canva Mobile App for HarmonyOS before v1.15.1. The flaw fails to restrict headers returned to an external origin running in a privileged WebView, allowing a threat actor with WebView control to access user session information. No public exploit has been confirmed at this time, but users should update to patched versions immediately.
CVE-2026-94094 is a denial-of-service vulnerability in OpenClaw's Canvas Host Route component affecting versions up to 2026.9.5. The flaw in the createCanvasHostHandler function allows remote attackers to trigger DoS by sending large file requests that are buffered entirely in memory instead of streamed. A public exploit has been released and the vendor was notified early.
Instructure Canvas confirmed a data breach on May 1, 2026, after detecting unauthorized activity on April 29. Threat actor ShinyHunters claimed responsibility and alleged exfiltration of 275 million records from 8,809 schools. The attacker exploited the Free-For-Teacher program; a secondary intrusion resulted in login-page defacement on May 7. Instructure reached a settlement agreement with ShinyHunters on May 11, and no confirmed public data dump has surfaced.
Canvas LMS suffered a major breach by ShinyHunters in May 2026 after a threat actor exploited a stored XSS vulnerability in a support ticket submitted via a Free-for-Teacher account. Attackers exfiltrated approximately 3.65 terabytes of data from roughly 275 million user records across nearly 9,000 schools, making it the largest education data breach on record. The incident exposed names, email addresses, student IDs, and private messages. Instructure patched the vulnerability and rotated credentials after reaching an alleged agreement with the attackers on May 11, 2026.
On July 16, 2026, Instructure paused delivery of breach notification data related to the May 2026 ShinyHunters incident after discovering that ShareFile, the third-party platform selected to distribute affected institutions' data, may have experienced a security incident. The delay halts transparency efforts following the April breach that affected 8,809 institutions worldwide.
In late April 2026, ShinyHunters breached Instructure's Canvas Learning Management System through stored cross-site scripting vulnerabilities in the Free-For-Teacher program tier. The attackers exfiltrated 3.65 terabytes of data affecting 8,809 institutions worldwide, defaced login pages at hundreds of schools, and disrupted student access during finals week. Instructure paid a ransom and discontinued the vulnerable freemium tier; a recompromise attempt occurred within 24 hours after the initial disclosure, revealing that the underlying trust boundary flaw persisted.
Canvas learning management system experienced a cyberattack affecting the University of Illinois and thousands of other institutions. Personal data was potentially compromised in the breach, with details indicating wide-scale impact across educational institutions using the platform.
ShinyHunters exploited a critical zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft between May 27 and June 9, 2026, affecting over 100 organizations—68% in higher education. The threat group, previously linked to the Canvas breach, gained unauthorized access to student records and other sensitive data. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated remediation for federal agencies by June 14.
A massive cyberattack targeting Instructure's Canvas LMS has been disclosed. The incident represents a significant security event impacting the widely-used educational learning management system, prompting discussions about security vulnerabilities in SaaS platforms used in educational settings.
ShinyHunters breached Instructure Canvas LMS in April 2026, stealing 3.65TB of data affecting approximately 275 million user records across 9,000 educational institutions. The threat group demanded ransom and disclosed the breach using the FFT vector. Canvas is widely deployed across schools and universities globally.
Instructure's Canvas learning management system has suffered a major data breach, with the ShinyHunters group claiming theft of approximately 275 million student and staff records spanning more than 7,000 universities and K-12 districts. The stolen dataset reportedly includes years of academic activity, communications, and other personal information tied to student identities. Disruptions to Canvas access during peak exam season led several US universities, including Harvard and Northwestern, to postpone final exams. Reports indicate Instructure paid the ransom demand, though attackers had already exfiltrated the data. Initial access is believed to have involved social engineering targeting identity, consistent with prior ShinyHunters tradecraft. Downstream risks include long-term phishing, impersonation, and identity fraud, particularly for minors whose identities may remain unmonitored for years.
Instructure has confirmed a data breach affecting its Canvas learning management platform that impacted educational institutions globally. The company stated it reached an agreement with the unauthorized actor that resulted in the return and destruction of the accessed data. Affected organizations include Pittsfield Public Schools in Massachusetts, where secondary student progress reports were among the data exposed, and Singapore government-supported institutes, where the Ministry of Education said no sensitive data appears to have been leaked. The full scope of impacted institutions and data categories has not been disclosed, and Instructure is continuing to notify affected customers. Institutions using Canvas should review notifications from Instructure and assess any downstream exposure of student or staff records.
Canvas, the Instructure-owned learning management system, was the subject of a hack disclosed in early May 2026 that exposed data from nearly 9,000 schools, including personally identifying information. Reporting frames the incident as part of a broader pattern of edtech breaches affecting student and staff records. Specific attack vectors, threat actor attribution, and the full scope of compromised data have not been detailed in this coverage. Schools using Canvas should monitor for official Instructure advisories, review account activity, and prepare for potential notification obligations. Severity is rated HIGH given the confirmed large-scale exposure of personal data across thousands of institutions.
Instructure's Canvas learning management system suffered a data breach disclosed on May 7, 2026, taking the platform offline during U.S. college finals period. The hacking group ShinyHunters claimed responsibility, with reports indicating exposure of personal information for over 275 million students, teachers, and staff across nearly 9,000 schools worldwide, including K-12 districts and universities. Instructure stated that no passwords, government IDs, or financial data appear to have been stolen, and the platform has since been restored. Some institutions, including Georgia Tech, advised users not to log back in immediately while investigations continued. The incident has caused significant academic disruption and remains under active review.