CyberMidnight Club — UAlberta Vulnerability Awareness PAGE 1 / 8 When Scanners Don't Sleep: The University of Alberta Vulnerability Report and the CyberMidnight Club Awareness Mission A Public Interest Article on Institutional Cybersecurity, Responsible Disclosure, and Cross - Border Digital Transparency General and cybersecurity - aware audiences | 2026 - 10 - 06 Introduction In October 2023, an automated cybersecurity scanner swept across the digital infrastructure of the University of Alberta — one of Canada's largest public research universities. What it found was a 930 - page report cataloguing thousands of potential vulnerab ilities. Three years later, that report has resurfaced in public discussions across Alberta and beyond. This article explains what happened, why it still matters, and how an independent cybersecurity awareness initiative called CyberMidnight Club is helpin g bring these systemic issues to light — responsibly, transparently, and without sensationalism. DISCLAIMER This article is based on independent OSINT (Open Source Intelligence) analysis and publicly available information only. It is produced for public awareness, education, and advocacy of better vulnerability - disclosure practices and digital rights. No affilia tion exists with any government agency, law enforcement body, university, dark - web actor, marketplace, or ransomware group in Canada, Uruguay, or elsewhere. The 2023 BeeHive scan report and any third - party datasets referenced here do not constitute proof o f current compromise, active exploitation, or confirmed data breach. Readers with personal data concerns are directed to official channels: ciso@ualberta.ca or abuse@ualberta.ca. Universities are among the most complex digital environments on the planet. A single institution like the University of Alberta operates hundreds of websites, research portals, administrative systems, and third - party tools — many of them maintained by indi vidual departments with varying levels of IT oversight. This complexity creates an enormous attack surface, and automated vulnerability scanners are increasingly used — by security firms, researchers, and independent analysts — to map that surface from the outside. The BeeHive Systems scan of ualberta.ca in October 2023 is a textbook example of what such an external scan looks like at scale. It is also a case study in a broader challenge facing institutions worldwide: what happens when vulnerability data becomes publ ic, and who is responsible for acting on it? CyberMidnight Club — UAlberta Vulnerability Awareness PAGE 2 / 8 CyberMidnight Club, the independent cybersecurity awareness platform founded by Alberto Daniel Hill, exists precisely to ask — and help answer — those questions. Drawing on lived experience, technical literacy, and a commitment to radical transparency, Cyb erMidnight Club uses podcasts, newsletters, video content, and community channels to bring institutional cybersecurity failures into the public conversation — in English, Spanish, and French. What Happened — The BeeHive Scan and Its Findings The Scan Between October 25 and 26, 2023, a cybersecurity firm called BeeHive Systems conducted an automated external vulnerability scan of the University of Alberta's web infrastructure. The scan ran for approximately 20 hours and 11 minutes, using Nuclei - based sc anning templates — a widely used open - source framework that checks systems against a library of known vulnerability signatures. The result was a 930 - page report containing 4,561 individual findings across the ualberta.ca domain and its associated subdomains. [G1] It is important to understand what this number means — and what it does not. The vast majority of findings (4,229 out of 4,561) are classified as "Informational" — meaning they identify technologies in use, configuration details, or missing security header s. These are not active attacks or confirmed breaches. They are observations about the digital environment, similar to noting that a building's windows are visible from the street. The findings that demand closer attention are the Critical and High severity items — a total of six findings that point to specific, named software vulnerabilities with known CVE (Common Vulnerabilities and Exposures) identifiers. Vulnerability Summary Table 1. BeeHive Systems Scan — Vulnerability Findings by Severity (October 2023) Severity Count Key Findings Critical 2 CVE - 2020 - 35489: WordPress Contact Form 7 unrestricted file upload (epicore.ualberta.ca, nanofab.ualberta.ca) High 4 CVE - 2021 - 31602: Pentaho auth bypass (2 endpoints); XploitSPY default login (facilities portal); CVE - 2023 - 26360: Adobe ColdFusion unauthenticated file read (med.ualberta.ca) Medium 34 Web.config exposures, WordPress username enumeration, phpMyAdmin CSRF, XSS variants, configuration detections Low 287 Weak ciphers, SSL/TLS issues, PHPinfo exposure, Git mailmap disclosures Informational 4,229 Technology fingerprinting, missing security headers, plugin detections, robots.txt entries Unknown 5 Generic token and credential disclosure checks Total 4,561 CyberMidnight Club — UAlberta Vulnerability Awareness PAGE 3 / 8 The Critical and High Findings Explained CVE - 2020 - 35489 — WordPress Contact Form 7 (Critical, CVSS 10.0) This vulnerability, published in December 2020, affects versions of the popular WordPress Contact Form 7 plugin before version 5.3.2. It allows an attacker to upload files without restriction, potentially leading to Remote Code Execution (RCE) — the abilit y to run malicious code on the server. The scanner detected the plugin's presence on two UAlberta subdomains. Importantly, detecting the plugin's readme file does not confirm that the vulnerable version is still running; many scanners flag the plugin path regardless of version. The vulnerability was patched upstream in December 2020. [G1] CVE - 2021 - 31602 — Hitachi Vantara Pentaho Authentication Bypass (High) Pentaho is a business intelligence and data integration platform. The vulnerability allowed unauthenticated users to access system role information — a stepping stone toward deeper unauthorized access. Two UAlberta endpoints were flagged. Hitachi Vantara h as issued guidance and later platform versions address the issue. [G1] CVE - 2023 - 26360 — Adobe ColdFusion Unauthenticated File Read (High) Adobe ColdFusion is a web application development platform used in many legacy enterprise environments. This 2023 vulnerability family includes paths to unauthenticated file access and, in some configurations, Remote Code Execution. Adobe released multiple security bulletins (APSB23 - 25 and subsequent) addressing these issues. ColdFusion instances require continuous patching to remain secure. [G1] XploitSPY Default Login (High) XploitSPY is an open - source Android remote access tool (RAT) framework. The scanner detected what appeared to be a default - credential login page on a University of Alberta facilities portal. This could indicate a misconfigured instance or a false - positive template match — but either way, any production exposure of such a tool would be a serious security concern. [G1] About BeeHive Systems BeeHive Systems is a privately held cybersecurity services firm founded around 2022 and headquartered in Wilmington, Delaware, USA. The firm advertises services including vulnerability scanning, managed detection and response, endpoint protection, and inci dent response. There is no public evidence that BeeHive was formally contracted by the University of Alberta for this specific scan. The report appears to be an external assessment product — a type of service increasingly common in the cybersecurity indust ry, where firms scan public - facing infrastructure and offer the results to the affected organization or publish them for awareness purposes. [G1] CyberMidnight Club — UAlberta Vulnerability Awareness PAGE 4 / 8 Why This Still Matters in 2026 Three Years Later — Has Anything Changed? The BeeHive scan was conducted in October 2023. It is now October 2026. Why does a three - year - old automated scan report still matter? The answer lies in a pattern that repeats across institutions worldwide: vulnerability reports are generated, filed, and sometimes forgotten — while the underlying systems continue to operate. Patch cycles are slow. Legacy software persists. And when a rep ort eventually surfaces publicly, it raises uncomfortable questions about what was known, when it was known, and what was done about it. In the case of the University of Alberta, the public record since 2023 includes several developments that add context to the original findings. [G1] The 2026 Canvas LMS Incident. In May 2026, the University of Alberta was among approximately 9,000 institutions worldwide affected by a cybersecurity incident involving Instructure's Canvas learning management system. The university issued public statement s confirming that the scope of data impact was under investigation and that certain sensitive data types were not stored in Canvas. This incident — entirely separate from the BeeHive findings — demonstrates that large institutions remain active targets and that third - party software dependencies create systemic risk that no single institution fully controls. Credential Exposure. Commercial threat intelligence platforms have reported ongoing credential exposure for the ualberta.ca domain in infostealer logs — datasets compiled by malware that harvests usernames and passwords from infected devices. These are not the result of a direct breach of UAlberta systems; they reflect the broader reality that users of any large institution's services may have their credentials compromised through attacks on their personal devices. Leadership Transitions. The University of Alberta has conducted a public search for a new Chief Information Security Officer (CISO) — a role historically associated with Gordie Mah, who gave public interviews on the topic around 2024. Leadership transition s in security functions can create temporary gaps in institutional knowledge and response capacity. The Broader Pattern The UAlberta case is not unique. It is representative of a systemic challenge facing universities, hospitals, government agencies, and other large public institutions: the gap between the pace of technology adoption and the pace of security remediation. Automated scanners like the one used by BeeHive can identify thousands of potential issues in hours. Fixing those issues — especially in a decentralized environment with hundreds of departmental websites and legacy systems — can take years. The information al findings in the BeeHive report (4,229 of 4,561 total) are largely expected for an institution of this size. The Critical and High findings, however, point to specific, named vulnerabilities with known remediation paths. The question is not whether these vulnerabilities exist in the abstract — it is whether the specific instances flagged have been addressed. That question can only be answered by the institution itself, through authorized internal testing and transparent public communication. Independent external scanners, including BeeHive, can identify potential issues but cannot confirm current exploitabilit y or patch status. CyberMidnight Club — UAlberta Vulnerability Awareness PAGE 5 / 8 Who Is CyberMidnight Club and Why Does It Matter The Voice Behind the Platform CyberMidnight Club (cybermidnight.club) is an independent cybersecurity awareness platform founded by Alberto Daniel Hill, a Uruguayan cybersecurity researcher and advocate. Hill's personal story is central to the platform's identity and mission: he was th e first person in Uruguay to be imprisoned for a computer - related case — a case that was later cleared. His experience is documented in Episode 25 of Darknet Diaries, one of the world's most widely listened cybersecurity podcasts. [G2] That lived experience — of being on the wrong side of a system that punished rather than understood — gives CyberMidnight Club a perspective that few cybersecurity platforms can claim. It is not a corporate security firm. It is not a government agency. It is an independent voice that combines technical literacy with personal accountability and a commitment to public interest. The Mission: Data Over Drama CyberMidnight Club operates under a clear editorial principle: DATA OVER DRAMA. This means grounding every claim in publicly verifiable sources, applying TLP (Traffic Light Protocol) classifications to content — a standard used by cybersecurity professiona ls to indicate how information should be shared — and refusing to sensationalize, speculate, or make claims that cannot be supported by evidence. The platform maintains strict independence from any government, law enforcement body, political party, or comm ercial actor. This approach is not just ethical — it is strategic. In an information environment saturated with hyperbole and misinformation, a platform that consistently delivers accurate, sourced, and clearly labeled content builds the kind of trust that drives real a wareness and real change. [G2] A Multi - Language, Multi - Platform Ecosystem CyberMidnight Club reaches audiences across three languages — English, Spanish, and French — through a carefully designed ecosystem of content formats and distribution channels: • Podcast: The CyberMidnight Club feed on Apple Podcasts, Spotify, and other directories delivers long - form analysis and the Architecture of Remorse audio - thriller series — a narrative, binaural production that applies the craft of audio storytelling to real cybersecurity case studies. • LinkedIn Newsletter: With approximately 3,500 subscribers, the newsletter delivers professional - tone analysis to a technically literate audience. • Telegram and Signal: Rapid TLP:CLEAR drops and community discussion for higher - trust audiences. • YouTube and Short - Form Video: Full episodes, localized versions, and 30 – 90 second shorts on TikTok, Instagram Reels, and YouTube Shorts — with captions in all three languages. • X (@ADanielHill): Real - time engagement, public commentary, and traffic to long - form content. • cybermidnight.club: A permanent forensic repository with a language switcher, serving as the authoritative archive for all published content. [G2] CyberMidnight Club — UAlberta Vulnerability Awareness PAGE 6 / 8 How CyberMidnight Club Is Spreading Awareness The Alberta Case as a Distribution Bridge The resurfacing of the UAlberta BeeHive report in public discussions across Alberta and Canada in 2026 represents exactly the kind of moment CyberMidnight Club is designed to address. Public accounts on X have amplified the report, connected it to other in stitutional cybersecurity concerns, and drawn attention to the gap between what automated scanners find and what institutions publicly acknowledge. CyberMidnight Club's role is not to be the loudest voice in that conversation — it is to be the most accurate and responsible one. The platform treats the Alberta material as one case study among many of long - lived scanner findings, institutional response patterns, and the value of independent public archives. It does not claim insider knowledge, ongoing unauthorized access, or confirmed active exploitation. [G2] Content Strategy for the UAlberta Case CyberMidnight Club's approach to the UAlberta vulnerability report follows its standard editorial framework: • Structural lessons, not accusations. Content focuses on what the findings reveal about systemic patterns — the persistence of legacy software, the challenge of decentralized IT governance, the slow pace of patch cycles — rather than attributing blame to sp ecific individuals. • Parallel narratives. The Alberta case is connected to similar patterns in Latin America, creating a cross - border conversation about institutional cybersecurity that resonates with audiences in Uruguay, Canada, and beyond. • Transparent sourcing. Every piece of content clearly labels its sources, dates, and the limits of what can be verified. The BeeHive report is identified as an external automated scan from October 2023; its current relevance is explicitly qualified. • Multi - language reach. The story is told in English for global and North American audiences, in Spanish for LATAM communities, and in French for Canadian bilingual audiences and Francophone listeners worldwide. The 90 - Day Roadmap CyberMidnight Club has outlined a concrete 90 - day plan for expanding awareness of institutional cybersecurity issues, including the UAlberta case: [G2] • Weeks 1 – 2: Publish an English deep - dive framing the theme of "scanner reports that outlive institutional memory," with a parallel short Spanish version. Seed content on Telegram, Signal, and LinkedIn. • Weeks 3 – 4: Launch a French pilot short and YouTube Shorts package. Expand the LinkedIn newsletter with a technical summary of the Alberta material and LATAM parallels. • Weeks 5 – 8: Release a full Architecture of Remorse - style episode in English and Spanish drawing structural lessons from the case. Maintain consistent short - form content cadence. • Weeks 9 – 12: Evaluate metrics, community feedback, and the legal environment; decide on deeper French production and possible live community calls. CyberMidnight Club — UAlberta Vulnerability Awareness PAGE 7 / 8 What You Can Do For General Readers If you are a student, staff member, or community member connected to the University of Alberta — or any large institution — there are practical steps you can take to protect yourself: • Use unique, strong passwords for your institutional accounts. Do not reuse passwords across services. • Enable Multi - Factor Authentication (MFA) wherever it is available. MFA significantly reduces the risk of account compromise even if your password is exposed. • Monitor official communications. The University of Alberta's IST Information Security team publishes security advisories and breach notifications. Stay informed through official channels. • Report suspected compromise. If you believe your account has been compromised or you have observed suspicious activity, contact abuse@ualberta.ca. • Be skeptical of phishing. Credential exposure in infostealer logs often leads to targeted phishing campaigns. Be cautious of unexpected emails asking for login credentials or personal information. For Cybersecurity Professionals and Researchers • Verify before amplifying. Automated scan reports identify potential vulnerabilities, not confirmed breaches. Before sharing or acting on such reports, verify current patch status through authorized channels. • Support responsible disclosure. If you identify a vulnerability in a public institution's systems, follow responsible disclosure practices: notify the institution's security team (ciso@ualberta.ca or abuse@ualberta.ca) before publishing. • Engage with independent platforms. CyberMidnight Club and similar independent platforms play an important role in the public cybersecurity conversation. Engage with them, contribute your expertise, and help raise the quality of public discourse. For Institutions • Prioritize Critical and High findings. Automated scans produce large volumes of informational findings, but Critical and High severity items — especially those with known CVEs and public exploit code — require prompt verification and remediation. • Communicate transparently. When vulnerabilities are identified and addressed, public communication builds trust. Silence creates uncertainty and fuels speculation. • Invest in centralized security governance. Decentralized IT environments are inherently harder to secure. Centralized configuration management, Web Application Firewalls (WAFs), and Content Security Policies (CSPs) can address many of the medium and low fi ndings at scale. Follow and Support CyberMidnight Club CyberMidnight Club's awareness work depends on an engaged audience. You can support the mission by: CyberMidnight Club — UAlberta Vulnerability Awareness PAGE 8 / 8 • Subscribing to the podcast on Apple Podcasts, Spotify, or your preferred platform. • Following @ADanielHill on X for real - time updates and public commentary. • Joining the Telegram channel at t.me/cybermidnight for TLP:CLEAR threat intelligence drops. • Subscribing to the LinkedIn newsletter for professional - tone analysis. • Sharing content responsibly — with context, with disclaimers, and with a commitment to accuracy over sensationalism. Conclusion The University of Alberta vulnerability report is not a story about a catastrophic breach. It is a story about the gap between what automated tools can find and what institutions choose to address — and about the role that independent, responsible voices c an play in closing that gap. CyberMidnight Club's approach to this case exemplifies what good - faith cybersecurity awareness looks like: grounded in public data, transparent about its limitations, focused on systemic patterns rather than individual blame, and committed to reaching audi ences across languages and borders. The findings in the BeeHive report — from the Critical WordPress vulnerability to the High - severity ColdFusion and Pentaho issues — are not unique to the University of Alberta. They reflect challenges that every large institution faces in managing a comple x, decentralized digital environment. The question is not whether such vulnerabilities exist. The question is whether institutions, researchers, and the public can work together — openly, honestly, and responsibly — to address them. That is the conversation CyberMidnight Club is committed to having. And it is a conversation that matters — in Uruguay, in Canada, and everywhere that digital systems shape the lives of ordinary people. STAY INFORMED For ongoing coverage of institutional cybersecurity, vulnerability disclosure, and digital rights: visit cybermidnight.club, follow @ADanielHill on X, and subscribe to the CyberMidnight Club podcast and LinkedIn newsletter. All content is produced independ ently, with mandatory disclaimers, and in the public interest. Sources G1. BeeHive Systems. University of Alberta (ualberta.ca) Vulnerability Assessment Report. October 25 - 26, 2023. Extended OSINT Analysis, October 2026. G2. CyberMidnight Club. Multi - Language Content, Distribution and Narrative Strategy. Alberto Daniel Hill. October 2026.