Canvas

This week is a gut check for anyone who thinks patching is optional. A Palo Alto firewall zero-day gives unauthenticated root — and it’s been exploited since April 9. ShinyHunters breached Canvas LMS, stole data from 8,800 schools, then defaced 330 university login portals during finals week. DigiCert, one of the world’s largest certificate authorities, was compromised through a malicious screensaver file that led to stolen code-signing certificates. RansomHouse hit Trellix, the cybersecurity firm born from the McAfee/FireEye merger. Ivanti dropped another EPMM zero-day — their third this year — and CISA gave agencies just three days to patch. And the vm2 Node.js sandboxing library has another escape, this time via WebAssembly. Meanwhile in the lab, we deployed Termix + Apache Guacamole for browser-based remote access, killed Gmail’s Smart Features, and took a hard look at homelab attack surfaces after Max’s weekly audit. ...