Trust infrastructure under assault: a CA compromised, a SaaS mega-breach, 1.5M servers exposed
A certificate authority is socially engineered and Defender turns on legitimate software. An education SaaS giant is extorted over data claimed to cover 275 million users. And an authentication bypass in cPanel leaves 1.5 million internet-facing servers exposed. Almost nothing this fortnight began with malware on a laptop.
Executive summary
- Trust infrastructure was the target, not endpoints. A certificate authority, an SSO-connected SaaS estate, a security vendor's source code and the authentication layer of 1.5 million hosting servers were the attack surface this fortnight.
- The vishing-to-SaaS pipeline is now the dominant breach pattern. Voice-phish an employee, capture SSO or OAuth access, register a rogue connected app, bulk-export the CRM. No malware at any stage.
- A compromised CA turned defence into denial-of-service. After fraudulent code-signing certificates were revoked, an anti-malware detection wave mass-flagged legitimately signed software worldwide for three days.
Key findings
Canvas LMS provider extorted; attackers claim 275 million users across 8,809 institutions
Attackers accessed Instructure's Canvas systems in late April and posted a ransom note claiming 3.65 TB of data covering roughly 275 million users: names, emails, student IDs and private student-teacher messages (no passwords or payment data, and figures are attacker claims). Entry came through the free-tier programme and an SSO-focused playbook, and login pages were later defaced when negotiations stalled.
DigiCert support portal breached; fraudulent code-signing certs, then a global false-positive wave
Attackers socially engineered CA support staff via a malicious file in a support chat, then obtained EV code-signing certificates later used to sign the Zhong Stealer malware family. DigiCert revoked 60 certificates, 27 linked to the actor. The fallout: an anti-malware detection published in the window mass-flagged DigiCert-signed binaries until a fixed signature update three days later, breaking legitimate software worldwide.
cPanel & WHM authentication bypass exploited as a zero-day for two months
An emergency patch landed for a CRLF-injection authentication bypass letting unauthenticated attackers forge a root session. Exploitation had been observed since late February; roughly 1.5 million instances are internet-exposed. CISA added it to KEV with an unusually tight 72-hour federal remediation deadline.
A security vendor's source code accessed; extortion group claims the scalp
A major security vendor confirmed unauthorised access to part of its source-code repository, with no evidence the release process was affected. An extortion group listed the company on its leak site days later. Extortion crews are increasingly targeting the security supply chain itself.
Third-party integrations and food-supply extortion round out the fortnight
A video platform confirmed ~119,000 users exposed via a compromised third-party analytics integration connected to its data warehouse, and the fortnight's most prolific ransomware group listed the world's largest food distributor with a leak deadline, publishing alleged internal documents as proof (unconfirmed by the company in the window).
The broader pattern
- Almost nothing began with malware on an endpoint. Identity, third-party integrations and trust anchors carried every major incident; signature-based detection saw none of it.
- OAuth-connected apps are the new lateral movement. A rogue connected app with bulk-export scopes looks like an integration, not an intrusion, unless behaviour is baselined.
- Even the trust layer needs behavioural monitoring. When a CA or a security vendor is the victim, allow-lists and signatures inherit the compromise.
Sector lens
Suggested priorities to consider
Based on this fortnight's public reporting, these are the areas we would review first. Weigh each against your own environment and risk profile.
Patch cPanel & WHM (CVE-2026-41940) and hunt back to February. Exploitation predated the patch by two months; treat exposed instances as presumed compromised.
Audit OAuth connected apps and their scopes across your SaaS estate. Rogue 'DataLoader'-style apps with full-API scopes were the exfiltration channel of the fortnight.
Brief helpdesk and support teams on vishing and support-channel social engineering. Both the CA compromise and the SaaS breaches began with a human being talked into something.
Review certificate-pinning and signing-trust assumptions. Fraudulently issued EV certificates signed real malware; revocation and detection fallout hit legitimate software too.
Check third-party integrations that hold credentials into your data stores. One compromised analytics vendor exposed a platform's warehouse; least-privilege those service accounts.
These suggestions are general commentary based on publicly reported events, provided for information only. They are not tailored security advice and may not suit your environment; validate against your own risk assessment and change-control processes before acting.
Blacklight baselines identities, connected apps and third-party service accounts alongside your endpoints, so a new OAuth grant with bulk-export scopes, a support-account doing something no support account does, or an anomalous export from your warehouse is investigated in minutes, with the reasoning shown. No malware required for the attack means no signature required for the catch.
Sources & methodology
Primary public sources this issue: Public breach disclosures and company statements (Instructure, Trellix, DigiCert, Vimeo) · CISA Known Exploited Vulnerabilities catalog and alerts (28 and 30 April 2026) · watchTowr and vendor analysis of CVE-2026-41940 · Push Security technical analysis of the Instructure breach · The Register, SecurityWeek, Help Net Security and BleepingComputer incident reporting · MITRE ATT&CK v15 for technique mapping. Attacker-claimed figures are labelled as claims.