Monthly Cyber Threat Intelligence for K-12 Schools and Districts

Summary

September proved the back-to-school window was dangerous. October showed the risk has not eased now that school is in session. Between September 20 and October 19, we tracked 10 confirmed or press-reported incidents at US K-12 schools and districts, 8 more schools listed only on ransomware leak sites, and 4 vendor or state-level incidents that touched many districts at once.

The dominant theme is third-party and identity risk. The California Department of Education disclosed that a single compromised credential on a testing vendor’s file-transfer site let an attacker copy statewide assessment files for almost four months, including disability, Section 504, and English-learner data.  This aligns with the trend in Clever’s Cybersecure 2026 survey (published in March), in which third-party breaches rose from 4% of district-reported breaches in 2023 to 32% in 2025.

Two broader forces sit behind all of this. First, AI is now part of real intrusions, not just research. For Illinois districts, the takeaway is to hold vendors accountable, tighten identity controls on people and applications, and patch internet-facing systems on a days-not-weeks timeline.

Monthly Areas of Focus

• • Citrix NetScaler – Three Zero-Days Exploited, Education Among Victims
  • Frontline Education Breach – Employee and Applicant Data Exposed
  • California State Testing Breach – One Stolen Credential, Millions of Student Records
  • Microsoft – Record Patch Tuesday, Exploited Windows Shell and SharePoint Flaws
  • Remote-Access and Network Infrastructure – Cisco, SonicWall, and Ivanti
  • ConnectWise Cloud Backup Suspended – Trusted Microsoft 365 Apps Abused
  • Phishing Beyond the Inbox – Device Codes, Calendar Invites, and Help Desk Calls
  • Endpoint Defense Evasion – Fake Installers, ChatGPT-Hosted ClickFix, Defender Tampering
  • Apple CoreGraphics Zero-Day (CVE-2026–86950)
  • Website Platforms – WordPress Core Exploited Within Hours, Critical Drupal Fixes
  • AI-Driven Attacks Move From Research to Real Intrusions
  • Building and Physical Systems Become Ransomware Targets
  • Old and Overlooked Software – LibreOffice, Legacy KEV Additions, Adobe
  • Law Enforcement Pressure – ShinyHunters, KillSec, and a Fraudulent “Recovery” Firm
  • Platform Changes and Planning Items

Summary

The back-to-school risk warned about in August became real. Seven school systems in five states reported cyber incidents in roughly three weeks. Springfield Public Schools (MA) closed for four instructional days and later learned from the FBI that student and staff data had been stolen. Other districts ran on paper, lost internet for a week, or shut down every connected device, phones included. Three of the seven appeared on ransomware leak sites.

Identity is the perimeter: phishing platforms now defeat SMS, push, and one-time-code MFA in real time.

The platforms districts depend on were just as exposed, and AI is shortening the time between a flaw’s disclosure and its exploitation while federal support shrinks.

The fundamentals are not optional: phishing-resistant MFA, fast patching of actively exploited flaws, real vendor accountability, and continuity plans that work when the network does not.

Monthly Areas of Focus

• PaperCut NG/MF Zero-Day (CVE-2026-81578 / CVE-2026-82078)
• Ubiquiti UniFi – Three Maximum-Severity Flaws
• Google Chrome Zero-Day (CVE-2026-85046)
• BigBear and Passkey-Themed Phishing – MFA Bypass Against Microsoft 365
• Mathspace Breach – EdTech Vendor Patch Gap
• IDScan and Florida DMV Breaches – 150M+ Identity Documents Exposed
• AI Crosses the “Critical” Line – Autonomous Exploit Discovery
• AI Assistants and Browser Agents Become an Attack Surface
• Avada WordPress Theme – Zero-Click RCE (CVE-2026-18431)
• Microsoft 365 Authentication Outage – Cloud Dependency
• Fake Installers and Malicious Browser Extensions
• CISA Retires Free Assessments – Shrinking Federal Support

Summary

August’s activity centered on stolen credentials and legitimate-looking prompts rather than sophisticated new exploits — and the vendors and platforms districts depend on were as exposed as districts themselves.

A credential-theft campaign exposed 3.5–4.8 million employee records from Microsoft Entra ID tenants; macOS moved further into attackers’ sights via an authentication bypass and a 30+ domain ClickFix campaign; a new TrickBot variant hid its C2 traffic inside DNS queries; and supply-chain exposure grew through the ChainDrop npm worm (400+ packages) and an unauthenticated WordPress core RCE (“wp2shell”).

This lands during the back-to-school window — the same stretch that forced Newton County, GA, and Sumner County, TN, to delay or shut down schools after cyber incidents last year.

Monthly Areas of Focus

• Critical macOS Screen Sharing Authentication Bypass — Active Exploitation (CVE-2026-65400)
• MacSync Infostealer — Rotating C2 Domain Infrastructure Targeting State/Local Government
• “WP2Shell” — Unauthenticated Remote Code Execution in WordPress Core (CVE-2026-63030 / CVE-2026-60137)
• Over 24,000 Internet-Exposed Server BMCs Leak Password Hashes via a 22-Year-Old Flaw
• SAP Commerce Cloud Critical RCE (CVE-2026-58231) — Exploited Days After Patch
• Azure/Entra Credential Theft Campaign Exposes Millions of Fortune 500 Employee Records
• ChainDrop — Self-Propagating npm Supply Chain Worm Infects 400+ Packages
• New TrickBot Variant Uses DNS Tunneling for Command-and-Control