Record · corpus.blog/posts/01a087dc-cbbc-72fd-8bdb-907d412917fe

The Instructure Canvas Breach (2026): How XSS in a Support Ticket Compromised 275 Million Students

scotthelme.ghost.io · published 15 June 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at scotthelme.ghost.io Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 23
Words captured: 3,532

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://scotthelme.co.uk/integrity-policy-monitoring-and-enforcing-the-use-of-sri/?ref=scotthelme.ghost.io

scotthelme.co.uk

https://www.instructure.com/incident_update?ref=scotthelme.ghost.io

instructure.com

https://www.instructure.com/resources/webinar/technical-deep-dive-recent-security-incident?ref=scotthelme.ghost.io

instructure.com

https://onedtech.philhillaa.com/p/a-technical-deep-dive-is-not-a-crisis-response?ref=scotthelme.ghost.io

onedtech.philhillaa.com

https://onedtech.philhillaa.com/p/instructure-is-risking-the-trust-that-built-canvas?ref=scotthelme.ghost.io

onedtech.philhillaa.com

https://onedtech.philhillaa.com/p/one-step-forward-one-step-back-instructure-cyber-attack-2026?ref=scotthelme.ghost.io

onedtech.philhillaa.com

https://www.bleepingcomputer.com/news/security/instructure-confirms-hackers-used-canvas-flaw-to-deface-portals/?ref=scotthelme.ghost.io

bleepingcomputer.com

https://www.bleepingcomputer.com/news/security/canvas-login-portals-hacked-in-mass-shinyhunters-extortion-campaign/?ref=scotthelme.ghost.io

bleepingcomputer.com

https://www.bleepingcomputer.com/news/security/instructure-reaches-agreement-with-shinyhunters-to-stop-data-leak/?ref=scotthelme.ghost.io

bleepingcomputer.com

https://techcrunch.com/2026/05/07/hackers-deface-school-login-pages-after-claiming-another-instructure-hack/?ref=scotthelme.ghost.io

techcrunch.com

https://www.theregister.com/cyber-crime/2026/05/12/congress-investigates-canvas-breach-after-instructure-cuts-deal-with-shinyhunters/5238927?ref=scotthelme.ghost.io

theregister.com

https://thehackernews.com/2026/05/instructure-reaches-ransom-agreement.html?ref=scotthelme.ghost.io

thehackernews.com

https://www.malwarebytes.com/blog/news/2026/05/shinyhunters-escalates-canvas-attacks-with-school-login-defacements?ref=scotthelme.ghost.io

malwarebytes.com

https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-05-12/technology-security-alert-ongoing-cybersecurity-incident-involving-canvas-learning-management-system?ref=scotthelme.ghost.io

fsapartners.ed.gov

https://businessinsights.bitdefender.com/technical-advisory-shinyhunters-breach-instructure-canvas-lms?ref=scotthelme.ghost.io

businessinsights.bitdefender.com

https://www.trendmicro.com/en_us/research/26/e/What-Is-the-Instructure-Canvas-Breach.html?ref=scotthelme.ghost.io

trendmicro.com

https://ailearninsights.substack.com/p/what-can-we-infer-from-canvass-technical

ailearninsights.substack.com

https://github.com/instructure/canvas-lms?ref=scotthelme.ghost.io

github.com

https://github.com/instructure/canvas-lms/blob/master/gems/canvas_sanitize/lib/canvas_sanitize/canvas_sanitize.rb?ref=scotthelme.ghost.io

github.com

https://nvd.nist.gov/vuln/detail/CVE-2021-36539?ref=scotthelme.ghost.io

nvd.nist.gov

https://github.com/andrew-healey/canvas-lms-vuln?ref=scotthelme.ghost.io

github.com

https://github.com/andrew-healey/example-canvas-xss-attack?ref=scotthelme.ghost.io

github.com

https://en.wikipedia.org/wiki/2026_Canvas_security_incident?ref=scotthelme.ghost.io

en.wikipedia.org