Instructure confirms hackers used Canvas flaw to deface portals (2 minute read)

2026-05-12

Instructure confirmed that ShinyHunters chained multiple XSS bugs in Canvas LMS user-generated content features to hijack authenticated admin sessions and deface login portals at thousands of schools with a ransom ultimatum.