Report DATA PRIVACY & CYBERSECURITY

Monthly Cyber Threat Intelligence for K-12 Schools and Districts

New cyber threats are always emerging, and K-12 schools are becoming an increasingly popular target. Every new exploit and vulnerability risks downtime or worse – a cyber incident that leaks sensitive data, disrupts learning, or hampers day-to-day operations.

Awareness and action are key to keeping emerging threats from landing. Our monthly cyber threat intelligence report helps your district’s technology leaders:

  • Stay ahead of the curve on new exploits impacting operating systems, networking equipment, and more
  • Understand each threat’s severity and relevance to K-12 technology environments
  • Reduce risk by pro-actively addressing vulnerabilities

Each month, our vCISO program publishes a short brief that summarizes current threats and a full report that explains each area of focus in detail. The latest month is open below.

Monthly Cyber Threat Intelligence

Each month’s summary and areas of focus, with links to the brief and the full report. Newest first.

Summary

The back-to-school risk warned about in August became real. Seven school systems in five states reported cyber incidents in roughly three weeks. Springfield Public Schools (MA) closed for four instructional days and later learned from the FBI that student and staff data had been stolen. Other districts ran on paper, lost internet for a week, or shut down every connected device, phones included. Three of the seven appeared on ransomware leak sites.

Identity is the perimeter: phishing platforms now defeat SMS, push, and one-time-code MFA in real time.

The platforms districts depend on were just as exposed, and AI is shortening the time between a flaw’s disclosure and its exploitation while federal support shrinks.

The fundamentals are not optional: phishing-resistant MFA, fast patching of actively exploited flaws, real vendor accountability, and continuity plans that work when the network does not.

Monthly Areas of Focus

  • PaperCut NG/MF Zero-Day (CVE-2026-81578 / CVE-2026-82078)
  • Ubiquiti UniFi – Three Maximum-Severity Flaws
  • Google Chrome Zero-Day (CVE-2026-85046)
  • BigBear and Passkey-Themed Phishing – MFA Bypass Against Microsoft 365
  • Mathspace Breach – EdTech Vendor Patch Gap
  • IDScan and Florida DMV Breaches – 150M+ Identity Documents Exposed
  • AI Crosses the “Critical” Line – Autonomous Exploit Discovery
  • AI Assistants and Browser Agents Become an Attack Surface
  • Avada WordPress Theme – Zero-Click RCE (CVE-2026-18431)
  • Microsoft 365 Authentication Outage – Cloud Dependency
  • Fake Installers and Malicious Browser Extensions
  • CISA Retires Free Assessments – Shrinking Federal Support
Read the brief (PDF)Read the full report (PDF)

Summary

August’s activity centered on stolen credentials and legitimate-looking prompts rather than sophisticated new exploits — and the vendors and platforms districts depend on were as exposed as districts themselves.

A credential-theft campaign exposed 3.5–4.8 million employee records from Microsoft Entra ID tenants; macOS moved further into attackers’ sights via an authentication bypass and a 30+ domain ClickFix campaign; a new TrickBot variant hid its C2 traffic inside DNS queries; and supply-chain exposure grew through the ChainDrop npm worm (400+ packages) and an unauthenticated WordPress core RCE (“wp2shell”).

This lands during the back-to-school window — the same stretch that forced Newton County, GA, and Sumner County, TN, to delay or shut down schools after cyber incidents last year.

Monthly Areas of Focus

  • Critical macOS Screen Sharing Authentication Bypass — Active Exploitation (CVE-2026-65400)
  • MacSync Infostealer — Rotating C2 Domain Infrastructure Targeting State/Local Government
  • “WP2Shell” — Unauthenticated Remote Code Execution in WordPress Core (CVE-2026-63030 / CVE-2026-60137)
  • Over 24,000 Internet-Exposed Server BMCs Leak Password Hashes via a 22-Year-Old Flaw
  • SAP Commerce Cloud Critical RCE (CVE-2026-58231) — Exploited Days After Patch
  • Azure/Entra Credential Theft Campaign Exposes Millions of Fortune 500 Employee Records
  • ChainDrop — Self-Propagating npm Supply Chain Worm Infects 400+ Packages
  • New TrickBot Variant Uses DNS Tunneling for Command-and-Control
Read the brief (PDF)Read the full report (PDF)
vCISO Program

Want help acting on these threats?

Districts in LTC’s vCISO program get more than this monthly intelligence: an assessment of where they stand, a prioritized roadmap, and board-ready reporting, with a vCISO coaching their technology team along the way. Questions? Contact Will Brackett at wbrackett@ltcillinois.org.

Explore the vCISO program

Author

Will Brackett
Director, vCISO Program, Learning Technology Center
View Profile: Will Brackett

Details

For Administrators, Technology Leaders/Support
Grade Levels All Grades (K-12)

Related Resources

See all Resources →
ResourceNew

FCC Cybersecurity Pilot Program

Where the FCC's $200 million Schools and Libraries Cybersecurity Pilot Program stands in 2026, what it pays for, and what participating Illinois schools and libraries need to do now.

Guidance
ResourceNew

Funding for Technology

A guide to the federal, state, and private funding Illinois K-12 districts can use for devices, networks, software, cybersecurity, and school safety technology, with what each source covers and where it stands for 2026-27.

Guidance
Resource

CIRR Assessment

Assess your K-12 district's cybersecurity preparedness with a free self-evaluation. Get scores, gap analysis, and a clear roadmap in under an hour.

Website

Keep Exploring

Topics in this Resource
Cybersecurity