Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #24

◆ cyber 85% high

a teacher opened a canvas support ticket in april carrying hidden code; three days later a support agent opened it, silently executing code in their browser, and within a week a known data-extortion group claimed 3.65 terabytes covering 275 million student accounts across 8,809 institutions. the chain exploited a stored cross-site-scripting flaw, weak session scoping and a missing security header. the scale — a quarter-billion students from one support ticket — is unusually large for a single education-platform compromise.

#data-breach#education#xss#extortion

Signals that echo this — the machine's nearest readings, by meaning

a cluster of large breaches surfaced together: the canvas learning platform was breached through a support-ticket flaw exposing 275 million student records and taken offline mid-finals, the council of europe confirmed theft of 429,000+ hr and payroll documents, and danish pharma novo nordisk disclosed theft of clinical trial data. the extortion group shinyhunters claimed the first two; the pharma intrusion has no claimed actor. 91%
the shinyhunters group exploited a critical oracle peoplesoft remote-code-execution flaw (cve-2026-35273, severity 9.8) across more than 100 organizations before the vulnerability was publicly disclosed, with 68 percent of victims in higher education and student billing and campus data stolen. mass exploitation of a zero-day ahead of disclosure, heavily concentrated on universities, is a notably targeted and well-timed campaign. 87%
a dense cluster of enterprise breaches surfaced on the same day: the shinyhunters extortion group claimed 300+ oracle peoplesoft instances across 100+ organizations and 3.8m medtronic records, while a russian-linked 'fortibleed' campaign reportedly stole 80,000+ firewall credentials from uk government and foreign office accounts targeting critical infrastructure including the nhs. an actively exploited sharepoint remote-code-execution flaw was added to the us cisa catalog. the concentration of high-scale intrusions in one window is structurally notable. 87%
a group calling itself shinyhunters exploited an unpatched oracle peoplesoft remote-code flaw (cvss 9.8) to breach more than 100 organizations between may 27 and june 9, with 68% of victims being us universities. the breach window lasted 13 days with no vendor advisory or patch available. mass exploitation of a zero-day against a single sector before any fix exists is a clean, high-impact intrusion event. 87%
a wave of large breaches consolidated on the same day: the conduent healthcare breach grew to 62.2 million people confirmed affected — now the third-largest on record, with attackers holding access from october 2024 until disclosure in june 2026 — while accenture confirmed unusual activity and a threat actor claimed 35gb of stolen source code, and israeli fintech nayax faced a claim of 1 billion card records taken. the clustering of mega-breaches disclosed within one cycle, some with years-long undetected dwell time, is structurally notable. 87%
a russian-speaking cybercrime group used approximately 1.16 billion credential combinations in mass login attempts against internet-facing fortinet firewall devices, successfully compromising 74,000 of them — roughly half of all accessible fortinet devices. this is structurally unusual not because of the technique, which is credential stuffing, but because of the scale and target specificity: perimeter security devices at this volume represent potential access to the internal networks behind them. the campaign is described as ongoing. 86%

Every link carries this card — rendered, not screenshotted

v19.2.0

a research project by Aamir Hussain