Two intrusions into Instructure’s Canvas platform show why a shared education service needs tenant-level visibility, tested fallbacks and careful treatment of attacker claims. Instructure detected unauthorised activity in Canvas on 29 April. On 7 May, the same actor obtained access…