✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
E-Learning
Breach intelligence, attack campaigns, and threat reports targeting the E-Learning sector.
Explore Other Sectors
E-Learning Threat Reports
Critical HTTP/2 Bomb Vulnerability Threatens Major Web Servers
In June 2026, cybersecurity researchers identified a critical remote denial-of-service (DoS) vulnerability, termed 'HTTP/2 Bomb,' affecting major web servers including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. This exploit leverages the HPACK header compression scheme in HTTP/2, allowing a single attacker to rapidly exhaust server memory by sending minimal data that results in significant memory allocation. A single client on a standard home internet connection can consume up to 32GB of server memory in approximately 20 seconds, rendering the server inaccessible. The discovery of the HTTP/2 Bomb underscores the evolving nature of cyber threats targeting foundational internet protocols. This incident highlights the necessity for continuous vigilance and prompt patching of server software to mitigate emerging vulnerabilities. Organizations are advised to review and adjust their HTTP/2 configurations to prevent potential exploitation.
1 month ago
Kill Chain
Critical Kirki Plugin Vulnerability (CVE-2026-8206) Exploited in WordPress Sites
In early June 2026, a critical privilege escalation vulnerability (CVE-2026-8206) was discovered in the Kirki WordPress plugin, affecting versions 6.0.0 through 6.0.6. This flaw allows unauthenticated attackers to reset passwords for any user account, including administrators, by exploiting the plugin's password reset function, which improperly handles email addresses. As a result, attackers can gain full control over affected websites, enabling them to install malicious plugins, alter content, and access sensitive data. The vulnerability was actively exploited, with over 222 attack attempts detected within a 24-hour period. A patch was released on May 18, 2026, in version 6.0.7, and users are strongly advised to update immediately to mitigate the risk. This incident underscores the ongoing risks associated with third-party plugins in widely used platforms like WordPress. It highlights the importance of prompt vulnerability management and the need for website administrators to stay vigilant about security updates to protect their sites from emerging threats.
1 month ago
Kill Chain
Critical Zero-Day in KnowledgeDeliver LMS Exploited to Deploy Web Shells
In late 2025, attackers exploited a zero-day vulnerability (CVE-2026-5426) in Digital Knowledge's KnowledgeDeliver Learning Management System (LMS). This flaw, stemming from hardcoded ASP.NET machineKey values across deployments, allowed unauthenticated remote code execution via malicious ViewState deserialization. Exploiting this, threat actors deployed the Godzilla (BlueBeam) web shell, enabling further system compromise and the distribution of Cobalt Strike beacons to users through malicious scripts embedded in the platform. This incident underscores the critical risks associated with default configurations and hardcoded cryptographic keys in web applications. The exploitation of such vulnerabilities highlights the necessity for organizations to implement unique, secure configurations and to stay vigilant against emerging threats targeting widely-used platforms.
2 months ago
Kill Chain
Critical Vulnerability in KnowledgeDeliver LMS Exploited to Deploy Malicious Payloads
In early 2026, a critical vulnerability (CVE-2026-5426) in Digital Knowledge's KnowledgeDeliver Learning Management System (LMS) was exploited by threat actors to deploy the Godzilla web shell and Cobalt Strike Beacon. The flaw, stemming from hard-coded ASP.NET machine keys, allowed unauthenticated remote code execution via malicious ViewState deserialization. This exploitation led to unauthorized access and potential data breaches in affected systems. The incident underscores the risks associated with default configurations and hard-coded cryptographic keys in software deployments. Organizations are urged to review and update their security practices to mitigate similar vulnerabilities, especially in widely used platforms like LMSs.
2 months ago
Kill Chain
Kimwolf DDoS Botnet Operator Arrested in Canada
In May 2026, Jacob Butler, a 23-year-old from Ottawa, Canada, was arrested for allegedly operating the Kimwolf botnet, a variant of the AISURU botnet. Kimwolf infected over a million IoT devices, including digital photo frames and web cameras, to execute massive distributed denial-of-service (DDoS) attacks. These attacks targeted global computers and servers, notably impacting the U.S. Department of Defense Information Network (DoDIN) with record-breaking volumes nearing 30 terabits per second. The botnet's operations resulted in significant financial losses, with some victims reporting damages exceeding one million dollars. ([justice.gov](https://www.justice.gov/usao-ak/pr/canadian-man-arrested-international-authorities-charged-administrating-kimwolf-ddos?utm_source=openai)) This incident underscores the escalating threat posed by IoT-based botnets and the critical need for robust cybersecurity measures. The arrest highlights the effectiveness of international collaboration in combating cybercrime, yet it also serves as a reminder of the persistent vulnerabilities within IoT ecosystems that can be exploited for large-scale attacks.
2 months ago
Kill Chain
Underminr Exploit: A New Threat to Web Security
In May 2026, researchers identified a critical vulnerability named 'Underminr' that exploits weaknesses in content delivery networks (CDNs) and Domain Name System (DNS) configurations. This exploit allows threat actors to manipulate web requests, enabling them to mask malicious activities behind the trusted reputations of legitimate websites. By leveraging this technique, attackers can conduct phishing campaigns, distribute malware, and perform data exfiltration while appearing to originate from reputable domains. The widespread nature of this vulnerability poses significant risks to organizations relying on CDNs for web content delivery. The emergence of Underminr underscores the evolving tactics of cyber adversaries who are increasingly targeting foundational internet infrastructure. This trend highlights the necessity for organizations to reassess their security postures, particularly concerning third-party services like CDNs, and to implement robust monitoring and mitigation strategies to defend against such sophisticated attacks.
2 months ago
Kill Chain
Ukrainian Authorities Uncover Major Infostealer Operation in 2026
In May 2026, Ukrainian cyberpolice, in collaboration with U.S. law enforcement, identified an 18-year-old from Odesa responsible for deploying infostealer malware between 2024 and 2025. This operation targeted users of a California-based online store, compromising 28,000 customer accounts. Of these, 5,800 accounts were exploited to make unauthorized purchases totaling approximately $721,000, resulting in direct losses of $250,000, including chargebacks. The suspect managed the infrastructure for processing and selling stolen session data, which allowed access to victim accounts without credentials, potentially bypassing multi-factor authentication. This incident underscores the escalating threat posed by infostealer malware, which has become increasingly sophisticated and prevalent. Recent reports indicate a surge in such attacks, with infostealers being used to steal billions of credentials annually, facilitating further cybercrimes like ransomware and supply chain attacks. Organizations must enhance their cybersecurity measures to mitigate these evolving threats.
2 months ago
Kill Chain
Critical Vulnerability in Funnel Builder Plugin Leads to WooCommerce Checkout Skimming
In May 2026, a critical vulnerability in the Funnel Builder plugin for WordPress was actively exploited to inject malicious JavaScript into WooCommerce checkout pages, aiming to steal customer payment information. The flaw, affecting versions prior to 3.15.0.3, allowed unauthenticated attackers to modify global settings via an unprotected checkout endpoint, leading to the execution of malicious code on every checkout page. FunnelKit, the plugin's developer, released a patch in version 3.15.0.3 to address this issue. This incident underscores the persistent threat of supply chain attacks targeting widely-used plugins to compromise e-commerce platforms. The exploitation of such vulnerabilities highlights the importance of timely software updates and vigilant monitoring of third-party components to safeguard sensitive customer data.
2 months ago
Kill Chain
Critical Vulnerabilities in Avada Builder Plugin Affect Over One Million WordPress Sites
In May 2026, two critical vulnerabilities were discovered in the Avada Builder WordPress plugin, affecting over one million active installations. The first, CVE-2026-4782, is an arbitrary file read vulnerability exploitable by authenticated users with at least subscriber-level access, allowing them to read sensitive files on the server. The second, CVE-2026-4798, is a time-based blind SQL injection vulnerability that can be exploited without authentication, enabling attackers to extract sensitive information from the database, including password hashes. Both vulnerabilities have been patched in version 3.15.3 of the plugin. This incident underscores the importance of timely software updates and the potential risks associated with widely used plugins. Organizations should prioritize patch management and consider implementing additional security measures to protect against similar vulnerabilities in the future.
2 months ago
Kill Chain
NGINX Vulnerability CVE-2026-42945: What You Need to Know
In May 2026, a critical vulnerability (CVE-2026-42945) was discovered in NGINX's ngx_http_rewrite_module, affecting versions 0.6.27 through 1.30.0. This heap buffer overflow flaw can be exploited by unauthenticated attackers using specially crafted HTTP requests, leading to denial-of-service conditions and, under certain configurations, remote code execution. The issue arises when NGINX configurations utilize both 'rewrite' and 'set' directives, a common pattern in API gateways and reverse proxy setups. The discovery of this 18-year-old vulnerability underscores the importance of regular code audits and timely patching. Given NGINX's widespread use across various industries, organizations are urged to update to the latest versions to mitigate potential risks associated with this flaw.
2 months ago
Kill Chain
Instructure's 2026 Data Breach: A Wake-Up Call for Educational Cybersecurity
In May 2026, Instructure, the company behind the Canvas learning management system, experienced a significant data breach orchestrated by the ShinyHunters extortion group. The attackers exploited vulnerabilities in the Free-for-Teacher environment, gaining access to over 3.6 terabytes of data, including usernames, email addresses, course names, enrollment information, and private messages from nearly 9,000 educational institutions worldwide. Following the initial breach, ShinyHunters defaced Canvas login portals, demanding a ransom to prevent the public release of the stolen data. Instructure reached an agreement with the attackers, who provided evidence of data destruction and assured that no extortion would occur against Instructure's customers. However, the FBI warns that paying ransoms does not guarantee that stolen data won't be sold or used in future attacks. This incident underscores the critical need for robust cybersecurity measures in educational platforms, especially as cybercriminal groups like ShinyHunters continue to target sensitive data for financial gain. Educational institutions must prioritize securing their digital infrastructures to protect against such threats.
2 months ago
Kill Chain
Instructure Canvas 2026 Cyberattacks: A Wake-Up Call for Educational Cybersecurity
In April and May 2026, Instructure's Canvas learning management system suffered two significant cyberattacks orchestrated by the ShinyHunters extortion group. The initial breach on April 29 led to the theft of personal information—including names, email addresses, student ID numbers, and user communications—from approximately 275 million individuals across nearly 9,000 educational institutions. Shortly after, on May 7, ShinyHunters executed a second attack, defacing Canvas login portals with ransom messages, disrupting access during critical final exams. Instructure responded by revoking compromised credentials, implementing security patches, and engaging forensic experts to investigate the incidents. ([apnews.com](https://apnews.com/article/3d55b9399ae87d49276f354e1c34c180?utm_source=openai)) These breaches underscore the escalating threats faced by educational institutions, particularly during pivotal academic periods. The incidents highlight the necessity for robust cybersecurity measures, proactive threat detection, and comprehensive incident response plans to safeguard sensitive student and staff data against increasingly sophisticated cybercriminal activities. ([apnews.com](https://apnews.com/article/209a51692f043a959459dbe37fb34e4b?utm_source=openai))
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports