Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

This growing exposure is reflected in real-world threat data. The Huntress 2025 Cyber Threat Report found that the education sector accounted for 21% of all cyber incidents observed last year, underscoring how frequently schools and universities are targeted. The report also highlights a strong presence of automated and data-driven attacks, with malicious scripts making up 24% of education-focused threats, followed by infostealers (16%), malware (13%), and ransomware (7%).

Globally, schools and universities now face over 4,300 cyberattacks per week on average, marking a 40% year-over-year increase and making the education sector a prime target for disruptive DDoS attacks. Most educational institutions operate with lean IT teams responsible for infrastructure, user support, and security. This resource constraint makes it difficult to withstand prolonged or application-layer DDoS attacks that can quickly disrupt learning platforms and administrative systems.

According to the State of Application Security 2025, web applications faced a sharp rise in hostile traffic, with 4.8 billion attacks blocked and 1.52 billion DDoS incidents affecting nearly 70% of monitored applications. APIs became the primary target, seeing 388% more DDoS attacks per host than websites, signaling a shift toward precision, application-layer disruption.

Recent research shows that the education sector now faces over 4,300 cyberattacks per week per organization, a 41% year-on-year increase. Education also consistently ranks among the top three most targeted industries globally, driven by the volume of sensitive student data and heavy reliance on cloud-based learning systems.

A critical remote code execution (RCE) vulnerability has been disclosed in n8n, a popular open-source workflow automation platform widely used to orchestrate business processes, SaaS integrations, and internal automation pipelines. Tracked as CVE-2025-68613, the vulnerability carries a CVSS score of 9.9 (Critical) and allows authenticated attackers to execute arbitrary system-level code on vulnerable n8n instances.

A critical code injection vulnerability has been identified in Apache Commons Text, a widely used Java library for text processing and interpolation. Tracked as CVE-2025-46295, the vulnerability carries a CVSS v3 score of 9.8 (Critical) and affects all versions of the library prior to 1.10.0. The vulnerability has an EPSS score of 0.253%, indicating a low short-term probability of exploitation.

In 2025, security benchmarks showed that over half of publicly disclosed vulnerabilities can bypass WAF protections when rule updates lag behind real-world exploits. Legacy WAFs were built for stable applications and predictable traffic. Today, frequent releases, API-driven architectures, and rapidly evolving attacks expose the limits of manual tuning and after-the-fact validation, leaving protection out of sync with reality.

According to the Indusface State of Application Security Report, SMBs now experience more attacks per application than large enterprises. Each SMB site facing an average of 2.24 million attacks per quarter, driven largely by malicious bot traffic and automated DDoS attempts. Despite this, many SMBs still operate with minimal security controls or legacy technology stacks, making them extremely vulnerable.