May Roundup of Trending News in Cybersecurity

Read more cybersecurity news in this edition of NetSecNews.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

Canvas Breach Disrupts Schools & Colleges Nationwide 

A nationwide cyber‑extortion attack on the Canvas learning platform—claimed by hackers who threatened to leak data from up to 275 million users—disrupted classes and forced schools to take the system offline during finals week. (Krebs on Security)

“Unlike traditional attacks that exploit software flaws, threat group ShinyHunters’ playbook relies on a familiar but effective tactic: social engineering. In this case, voice phishing (vishing) was used to gain access to Instructure, like their successful breach in September 2025, where they also gained access to Instructure’s Salesforce environment.  Be cautious with any communication—whether it comes via email, text, or phone. Attackers are increasingly leveraging trusted platforms and human behavior rather than technical vulnerabilities. If you are unsure if a voicemail, email or text message is legitimate, reach out to your contact via trusted form of communication to verify.  This incident is another reminder that SaaS platforms introduce shared risk. Even when vendors respond quickly, downstream exposure can be difficult to fully control.   Bottom line: You may not be able to prevent every breach—but you can limit the blast radius.“ –Andrea Spriet, Tier 2 SOC Analyst at C3

Fake OpenAI repository on Hugging Face pushes infostealer malware 

A fraudulent OpenAI–branded project on Hugging Face briefly went viral and duped users into installing data stealing malware disguised as a legitimate AI tool. (BleepingComputer) 

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions 

A newly revealed “Dirty Frag” vulnerability in the Linux kernel lets attackers with limited access reliably gain full root privileges across major systems. (The Hacker News)

New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges 

A newly published proof‑of‑concept “RedSun” zero‑day exploit abuses Microsoft Defender’s file-handling behavior to overwrite system files and give attackers full SYSTEM‑level privileges, even on fully patched Windows systems. (BleepingComputer)

Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execut… 

A critical PAN‑OS “Captive Portal” zero‑day is being exploited to let unauthenticated attackers remotely execute code with root privileges on Palo Alto firewalls, enabling full compromise of exposed network edge devices. (Unit 42)