Education
Canvas Goes Dark for 9,000 Schools Mid-Finals
ShinyHunters defaced the Canvas login page on May 7 and pulled millions of students offline during finals week, two days after Instructure called the breach contained.
Cybersecurity
Technology
Ubuntu's Bad Week: Root Hole, DDoS, and an LTS in the Crossfire
Three things hit Ubuntu in nine days: a root-level Linux kernel exploit dropped without coordinated patches, a pro-Iran DDoS that knocked Canonical's web infrastructure offline, and the 26.04 LTS release landing in the middle of both. Here's what it means for whatever you use Ubuntu for.
Technology
Bluekit Productizes Phishing: The AI Is Almost Beside the Point
A new phishing-as-a-service kit ships with an AI assistant, 40+ templates, and an adversary-in-the-middle proxy that defeats SMS and TOTP MFA. The AI is the part the press loved. The AiTM is the part defenders should actually worry about.
Technology
How a Single Semicolon Got Past GitHub's Push Pipeline
Wiz researchers found a critical RCE in GitHub's git push pipeline on March 4. The fix on github.com landed 75 minutes later. The April 28 disclosure makes clear what nearly happened — and why GitHub Enterprise Server admins still have urgent work.
Technology
Old Google API Keys Now Open Gemini, Draining Cloud Bills
Google spent a decade telling developers that Maps and Firebase API keys are not secrets. When Gemini was added to the Google Cloud Platform, those same keys silently gained the ability to make billable Gemini calls — and the bills started arriving. One team of three developers woke up to a $82,314 charge. The architectural fix is still pending.
Healthcare IT
Medtronic Confirms IT Breach as ShinyHunters Claims 9M Records
Medtronic disclosed on April 24 that an unauthorized party accessed corporate IT systems. ShinyHunters claims 9 million records and terabytes of internal data. Medtronic confirms only the corporate-IT scope and says products, patient safety, and manufacturing networks are unaffected — a careful framing that healthcare IT readers will recognize.
AI
NSA Is Using Anthropic's Mythos Despite the Pentagon Blacklist
Axios reports the NSA is using Anthropic's unreleased Mythos model — the one Anthropic says can find zero-days autonomously — despite the Pentagon formally labeling Anthropic a supply-chain risk. Here's what Mythos is, who else has access, and why the operational need is winning.
Healthcare IT
Brockton Hospital, Two Weeks on Paper, and the Anubis Playbook
Anubis claims 2 TB of patient data from Signature Healthcare's Brockton Hospital. Ambulances were diverted, chemo was canceled, and staff will be working off paper for two more weeks.
Healthcare IT
ChipSoft Ransomware: 80% of Dutch Hospitals Share One Vendor
ChipSoft — the Dutch EHR vendor whose HiX platform runs patient records at roughly 80% of Netherlands hospitals — was hit by ransomware on April 7. Eleven hospitals disconnected, and the bigger story is the concentration risk that made this inevitable.
Technology
Your Home Router Is Your Company's Security Problem
Russian military hackers compromised 18,000 home routers to steal Microsoft 365 tokens — after users completed MFA. Most enterprises harden the laptop but never ask what router it's connected to.