PHP2Shell: why Canadian government websites went offline, and what to check on yours
Two critical PHP flaws disclosed Oct. 21, 2026 took federal sites and Elections BC offline as a precaution. If your website runs PHP, update it now.
Resources
Breaches & threats
What happened, how, and what it changes for the rest of us.
A running record of breaches, ransomware incidents and vulnerability advisories. Each entry says what happened, how the attacker got in, and what it means for an organization that isn't in the headline. Written to inform, not to frighten.
102 entries, 81 breach reports and 21 threat advisories. For longer-form writing, see Insights.
A Rank Math PRO download carried a backdoor: how to check your WordPress site
Rank Math PRO 3.0.123, downloaded Oct 15-16, 2026, held a backdoor. If it was activated, restore a clean backup, change passwords and install 3.0.124.
Save-On-Foods More Rewards breach: what members should do
Pattison Food Group says More Rewards member data was accessed in an Oct. 13, 2026 breach. Passwords and cards weren't, it says. Watch for phishing.
BeyondTrust Remote Support: an exploited flaw and a Cyber Centre alert
Canada's Cyber Centre warned Oct. 16, 2026 that a BeyondTrust Remote Support flaw is exploited. Self-hosted users should patch and check for compromise.
Burnaby School District says ransomware attack may have exposed student and parent information
Burnaby School District says its Sept. 21, 2026 ransomware attack may have exposed student and parent details. What was taken and what to do now.
Microsoft's October update fixes an exploited Windows flaw, and is the last for Windows 11 24H2 Home and Pro
Microsoft's Oct. 13, 2026 update fixes an exploited Windows Shell flaw and is the last for Windows 11 24H2 Home and Pro. Install it, then move to 25H2.
Citrix NetScaler: a new critical flaw, and Canada's Cyber Centre updates its alert
Canada's Cyber Centre updated its Citrix NetScaler alert on Oct. 9, 2026 with a new critical SAML flaw. Patch to the latest build and check for compromise.
Canada and allies warn of China-linked attacks on Microsoft 365 and web servers
On Oct 8, 2026 Canada's Cyber Centre and allies warned a China-linked firm is password-spraying Microsoft 365. Turn on MFA and patch web servers.
Attackers are using a Ninja Forms flaw to take over WordPress sites
Since Oct 5, 2026 attackers have used a Ninja Forms flaw to add hidden admins to WordPress sites. Update to 3.15.4 and check for unknown accounts.
FBI says FortiBleed attacks on Fortinet firewalls are still active
On Oct 6, 2026 the FBI warned FortiBleed is still hitting Fortinet firewalls and VPNs. Check accounts, reset passwords and turn on MFA now.
Health Sciences Centre Ransomware Attack in Winnipeg: What We Know So Far
Health Sciences Centre Winnipeg confirmed a ransomware incident on August 10, 2026 hitting HVAC and door-access systems, with clinical care unaffected.
Origin Energy Investigating Data Breach Affecting Up to 2 Million Customers
Origin Energy is investigating a breach after a hacker claimed access to about 2 million customer records, including names, addresses and billing history.
Chick-fil-A Data Breach Exposes Personal Information from Loyalty Accounts
Chick-fil-A's loyalty program was hit by a credential-stuffing attack in June 2026, exposing customer names, contact details, and partial card numbers.
Lakelands Public Health Data Breach Impacts 60,000 Residents
A cyberattack on Lakelands Public Health in Peterborough exposed health records for about 60,000 residents, spanning nearly three decades of data.
Medtronic Data Breach Impacted Close to 300,000 Healthcare Customers
Medtronic disclosed a cybersecurity incident exposing personal and healthcare data for roughly 300,000 individuals, with no impact on device operations.
Qilin Ransomware Strikes Canadian Manufacturing Leader Chamco
The Qilin ransomware group claims to have stolen data from Canadian manufacturer Chamco and is threatening to publish it unless a ransom is paid.
Mount Royal University Responding to Cyber Attack in Calgary
A cyberattack disrupted Mount Royal University's website, campus internet and phone systems, with investigators still assessing data impact.
Privacy commissioner investigates Crime Stoppers tip platform breach
Canada's privacy commissioner is investigating Navigate360, whose hacked platform held Crime Stoppers tips. Who's affected and what to do now.
Pear Ransomware Targets K & E Distributing in Canada
The Pear ransomware group claims to have stolen data from Canadian distributor K & E Distributing and is threatening to publish it in a full leak.
Ultrahuman Data Breach Exposes User Information Through Internal Analytics Tool
A breach at wearable maker Ultrahuman exposed contact details, account info, order history and transaction records, no passwords or payment data exposed.
Beacon Mutual Insurance Data Breach 2026: Social Security Numbers Exposed
Beacon Mutual Insurance disclosed a breach exposing names and Social Security numbers after unauthorized access between January 7 and 14, 2026.
Qilin Ransomware Targets Monir Precision Monitoring in Canada
The Qilin ransomware group claims to have stolen data from Canadian firm Monir Precision Monitoring and is threatening to publish it unless it pays.
Canvas Data Breach 2026: Universities Worldwide Impacted
Instructure confirmed the Canvas LMS breach exposed names, emails, student IDs and messages at universities worldwide, including several in Canada.
Elections Alberta Data Breach Sparks Probe Demand
Alberta's Opposition has demanded an emergency hearing after a reported data breach at Elections Alberta raised questions about voter data and delays.
Want to know what this would look like for you?
A 30-minute call. No slides, no audit fee, no obligation. We ask what is breaking and tell you honestly whether we are the right fit.