Dr. Joe Phillips

Most people watching the @SpaceX IPO saw a rocket company go public but missed the bigger story.

What @elonmusk is building across all his companies is a single, integrated system.

A Civilization Stack.

I explain in my newest @Substack

open.substack.com/pub/drjoephill…

Sharing my @Substack Substack article about the @Canvas_by_Inst hack.

There are a lot of lessons learned from this hack. Explained in the article.

Further, when @MyPowerSchool and @InfiniteCampus were hacked, each CEO met with me personally to walk me through the hack, explain how Shiny Hunters got in, and the steps they had taken to secure their applications.

However from @Instructure it has been radio silence, weird inaccurate PR messages, bringing the site up before taking effective and routine safety measures,

and no one from the C-Suite, let alone CEO @smdaly, will respond to me or anyone else it seems.

and they are not providing any meaningful and necessary information for thousands of districts/colleges/universities to safely reenable their instances.

I explain more in this article.

open.substack.com/pub/drjoephill…

Canvas Being "Back Up" Doesn’t Mean Canvas is "Secure" in fact, it’s not.

As my team manages the fallout of the recent @Canvas_by_Inst @Instructure breach, one thing is clear:

A vendor's "Status Page" is not a security strategy. And it is not a communication strategy:

While the vendor reports that systems are operational, our internal audits tell a different story.

Despite our team killing all official authentication pathways, we discovered that staff and students were still able to access the system.

This means active session tokens and mobile credentials were never invalidated globally.

In a high-stakes hack involving a group like ShinyHunters, who specialize in session hijacking, this is more than a technical oversight; it is a massive liability.

And thousands of teams like mine across the globe are having to deal with it.

The Reality on the Ground

• Persistence of "Ghost Sessions": By failing to force a global logout, the vendor has left backdoors wide open. Attackers don’t need to crack a password if they can ride an existing session token into our infrastructure.

• A Communication Vacuum: Support and communication from Instructure has been minimal to non-existent. And the communication we do get is from sales reps or VPs who continuously tell us they do not know what’s going on but they are sorry.

• Ineffective Direction: Rather than terminating these sessions on their end, the vendor sent out directions that simply do not work. We are being left to troubleshoot a vendor-level security failure in the dark.

• The Risk of Contagion: Leaving these sessions active creates a lateral bridge to our broader network. My team cannot allow access to the Canvas, nor will we hook it back into our other internal systems, until this is fully resolved and verified.

Worst of all, by declaring the system "back up" prematurely, they are effectively shifting the blame for the continued outage onto the districts. This narrative punishes leaders who are doing the necessary work to ensure the safety of their environments.

And it puts at risk those districts that may not have the resources to identify these "ghost sessions" and unknowingly restore access to a compromised environment.

And their internal comms show considerable hedging, their security team states:

“We treat the threat as contained and eradicated based on our current knowledge, and working on restoring the product completely.
 
Based on our investigation, there is no evidence of persistent access for the threat actor, or any signs that would indicate further compromise.
 
To the best of our knowledge the product should be back to normal operations.”

We are keeping the system locked down until we can verify that every session is purged and every API "handshake" is secure.

It is time for the EdTech industry to prioritize actual recovery over PR-friendly status updates.

And for CEOs like @smdaly to ensure that their companies make the actual safety of their systems the top priority.

Just powered my latest @Substack. Escape Velocity: Breaking Free from AI Pilot Purgatory. I’d love to know your thoughts.

drjoephillips.substack.com/p/escape-veloc…

There are several Amazing EdTech solutions, but there are also a lot of Junknologies. I explain in this article.

I’d love to know your thoughts.

linkedin.com/pulse/junknolo…