Louisville InstructureCon opens as Canvas breach dossier stays paused

Digital Attitudes, 20 July 2026

Term 3 opens today in NSW, South Australia and the ACT. Victoria and Queensland are already back. Four things sit on the Term 3 desk before homeroom, and only two of them are on the sector's own calendar.

InstructureCon 2026 opens tomorrow with the IgniteAI mainstage and no Canvas dossier on the room's laptops

InstructureCon 2026 opens on Tuesday 21 July at the Kentucky International Convention Center in Louisville and runs through Thursday 23 July, with Instructure chief executive Steve Daly and chief product officer Shiren Vijiasingam booked for the mainstage product roadmap. The theme is "Education in the Making", the IgniteAI product roadmap (SpeedGrader Grading Assistance generally available since Saturday 18 April, quiz generation and Turnitin integration next) is the standing agenda item, AWS is the exclusive Diamond Sponsor, and 71 ed tech partners are in the exhibit hall alongside Michael Horn, Anne-Laure Le Cunff and Heather McGowan on the keynote list (Instructure on InstructureCon 2026, 8 July).

Why this matters: For every Australian university and TAFE on the affected Canvas tenant list (UTS, RMIT, Western Sydney, TasTAFE, Flinders and the rest that disclosed in May), the roadmap Vijiasingam ships in Louisville lands the same week the paused ShareFile dossier does not. The Term 3 read is that the vendor whose remediation delivery timeline is now open ended is standing on the mainstage rolling out AI grading features into a Semester 2 assessment cycle that the CISO has not yet been able to close the breach ticket on. The ANZ user group is watching the SpeedGrader Grading Assistance session more closely than the keynotes, because the "how does this touch student data" question needs an answer before the Term 3 marking window opens, and CanvasCon ANZ on Monday 24 and Tuesday 25 August in Sydney is where that answer lands in the local channel. Any ANZ tenant sending a delegate should book them into the AWS Diamond Sponsor track as well, because the compute perimeter question the sector has been asking of Anthropic and OpenAI is now sitting inside the Canvas roadmap too.

Progress patches the ShareFile zero day, and Instructure has still not restarted Canvas dossier delivery

Progress Software lifted the emergency shutdown order on Tuesday 14 July that it had issued the previous Friday 10 July for ShareFile Storage Zone Controllers, releasing patched versions 5.12.5 and 6.0.2 that address a high severity path traversal vulnerability in the 5.x and 6.x branches. The zero day allowed an authenticated administrative user to read arbitrary files accessible to the service account, write attacker controlled content to arbitrary directories, or enumerate the server filesystem. Progress has reserved a CVE identifier but said it would delay publication for two weeks to give customers time to patch before details went public (BleepingComputer on Progress confirming the ShareFile zero day behind the Storage Zone shutdown, 14 July).

Why this matters: This is the vulnerability that took the Canvas breach dossier delivery offline on Tuesday 14 July, four days after Australian and international Canvas tenants had nominated their security contacts. The patch is out, but Instructure's own incident update page still reads paused with no revised delivery date, which means every affected ANZ tenant is now waiting on two separate calls (Instructure's vendor decision and Instructure's own scheduling) before the response letter to affected staff and students can be finalised. For every Australian CISO whose tenant sits behind ShareFile Storage Zone Controllers for something other than the Canvas dossier (institutional file share, research data transfer, contractor onboarding), the check to run this week is whether 5.12.5 or 6.0.2 is on the tenant's own controllers, because the "we are downstream of Instructure's problem" line does not carry when the same product is in the vice chancellor's own file share. The audit committee question that writes itself: is ShareFile a single vendor, listed once, in the tenant supply chain register, or is it listed twice (Canvas remediation and general file share) with two separate risk owners.

NAPLAN individual student reports arrive at Australian kitchen tables this week

NAPLAN individual student reports go out to families this week for the 2026 cohort in Years 3, 5, 7 and 9, timed to early Term 3 by ACARA and the state assessment authorities. This is the first parent facing report written after the 11 March 2026 online platform outage that took the test down for two and a half hours on day one across more than a million students, and national aggregate results land in early August (ACARA on NAPLAN testing concludes for 2026, 27 March).

Why this matters: For every principal, deputy and business manager who spent Term 2 fielding parent questions about the day one outage and the writing test reschedule, the individual student report arriving this week is the second wave of that same conversation, and the first parent teacher night of Term 3 needs a written line by Wednesday. The literacy and numeracy scores are the parent story, but the platform is now the leadership story, because the Education Ministers Meeting on Tuesday 15 July put "actions to mitigate platform interruptions to future NAPLAN test events" into the communique without naming a fix. A school that had to reschedule Year 7 writing in March is a school whose parent portal open rate spikes this week, and the FAQ that goes into the portal needs the platform mitigation line pulled straight from the communique, not a state department circular that still assumes single day, single window testing on the current platform. The other operational read is for the deputy who has to compare an outage year against a non outage year in the school data pack: the standard error bar on any 2026 to 2025 comparison is wider than usual, so the executive brief that names a trend based on this week's data needs a written caveat.

Victoria's Term 3 device policy guidance clock is already running

The Victorian Department of Education promised in the Deputy Premier's Sunday 15 June announcement that further guidance for secondary schools would be released in early Term 3 2026, and Term 3 opened in Victoria last Monday 13 July, which means the clock started a week ago and the sector is now waiting for the paper. The guidance has to clarify how secondary schools reflect "planned device free learning time" in their teaching and learning programs from Term 1 2027, and how the primary school recommendations (Foundation to Year 2 minimal use other than learning about digital technologies, Years 3 to 6 maximum 90 minutes per day) sit alongside NAPLAN online preparation and the Digital Technologies v2.0 curriculum outcomes (Victoria Premier's office on less time on devices means more time learning, 15 June).

Why this matters: For every Victorian secondary principal and every Year 3 to 6 primary lead, the guidance that arrives in the next fortnight will decide whether the 2027 timetable can hold the current NAPLAN prep time or has to trim it, and whether the digital learning coordinator has a document to hand to the head of curriculum before the Term 3 professional practice day. The bit worth pushing on with the department is what "planned device free" looks like in a classroom that also has to hit the Digital Technologies v2.0 curriculum outcomes on the same timetable, because the two documents will read at different rhythms unless the department publishes an alignment table. The other read is for independent and Catholic sector CIOs, whose device deployments will be benchmarked against the state guidance whether or not the sector is bound by it, and the state's answer will land inside the ISV and Catholic Education Commission Term 3 papers by mid August, alongside the same NAPLAN parent conversation everyone else is having.

Coffee down. One US conference on the mainstage, one patched vendor vulnerability still holding a dossier, one round of parent reports, and one Victorian policy paper due in the fortnight. Term 3 has started. More at digitalattitudes.com.au.