Cybersecurity in universities: How campuses are easy prey for AI-powered attacks

On Saturday, October 17, 2026, while most university campuses were closed for the long weekend, a cyber attacker was remotely testing web servers with a hitherto unknown flaw; the world came to know of it four days later. If any of those servers had been your university’s Learning Management System (LMS) or web portal, would anyone have noticed? 

Recent research by Check Point, a globally recognised cybersecurity leader, ranks the education sector as the most cyber-attacked among 23 sectors. Between January and July 2026, an average institution globally faced 4,696 cyberattacks per week, more than double the industry average. In the Asia-Pacific region, it was much higher at 7,452. 

By design, higher education campuses are open, with thousands of personal devices such as smartphones, tablets, and laptops. Every year, a new batch of inexperienced freshers joins the campus. The universities collect their personal details such as Aadhaar, bank details, degree certificates, and contact details. IT departments in universities are often decentralised and short-staffed. As admissions and examinations are held as per pre-fixed calendars, attackers know when a campus is under pressure. 

In May 2026, hackers breached a U.S.-based Learning Management System (LMS) platform, CANVAS, used by over 8,800 institutions worldwide, with data of over 275 million students and posted ransom notes on login pages during final examinations. In 2022, hackers disrupted digital operations at AIIMS New Delhi and forced the hospital to run services manually for about two weeks. In August 2026, a ransomware group claimed the University of Delhi as a victim, though the claim was not independently verified. 

On October 21, 2026, PHP (Hypertext Preprocessor), the open-source, free programming language behind WordPress, Moodle LMS and most campus portals, fixed two critical flaws called “PHP2Shell”, which allowed a cyber attacker without any password take control of a web server. All PHP software versions released in the last decade were affected. 

Days earlier, eight private keys of eMudhra, a Bengaluru-based digital certificate authority that certifies the genuineness of a website, were found to be simple numbers that AI could easily decipher: just four, instead of a 116-digit random number. 

On October 15, 2026, the Government of India’s Computer Emergency Response team (CERT-In ) issued a critical advisory that frontier autonomous AI agents under testing are reaching the live systems of Indian organisations, and criminals are using open-source. It also added that the causes are conventional weaknesses like exposed passwords. A few days later, State Bank of India confirmed leakage of data of its 3,897 customers on dark web. 

AI attackers exploit age-old traditional lapses 

Exposed passwords and keys, APIs left open by mistake, keys stored in plain text form, liberal cloud permissions, and administrator panels without multi-factor login; conventional lapses did not change. 

AI did not invent new ways in; it easily opened the doors to them. Campuses are full of such open doors. 

AI can write in a second gullible phishing emails, fake the voice of a Vice-Chancellor tricking students for an urgent payment, and produce malicious code when apps built with AI assistants go online unchecked. While open-source software like WordPress, PHP, and Moodle is free, they run the risk of a lack of ownership for maintenance. 

With education the most-attacked sector worldwide and the DPDP Act holding institutions liable for student data, campuses need audited vendor contracts, real policies and student red teams, not paper compliance 

Most software, such as for admissions, ERP, examination, and LMS are outsourced or bought off the shelf, yet under the DPDP Act the institution is answerable for data privacy and security. 

Your vendor’s problem is your problem. Vendor contracts must include clauses for quick support within 24 to 48 hours, breach notification fast enough to meet CERT-In’s six-hour reporting rule, a right to audit, and annual testing by CERT-In-empaneled auditors. Maintenance contracts must include security updates. Vendors should access individual accounts with multi-factor authentication, and every outsourced application should be backed up , with offline fallbacks for examinations if a supplier goes down. 

Guardrails for the future

Most often, a campus cybersecurity policy is prepared for the purpose of accreditation and soon forgotten. Such a paper policy protects nothing unless it is strictly implemented with clear accountability, along with independent audits and reporting to the Board of Governors. 

Every campus has ample skilled manpower resources: inquisitive students and capable faculty. Instead of treating them as sources of risk, institutions can groom them into ethical hackers and responsible auditors. 

A supervised student “red team”, led by computer science faculty, can be authorised to test campus systems against a written scope and rules of engagement, preferably on test data. Faculty can be authorised to conduct internal audits against a standard checklist, and students can earn credits or internships by helping run a campus security operations desk, monitoring alerts under supervision. The institution can get the benefit of continuous testing at low cost; students graduate with real-life hands-on experience in a field short of skilled people. 

The University Grants Commission (UGC) and All India Council for Technical Education (AICTE) may issue baseline cyber-hygiene guidelines, and accreditation could ask for cyber audit evidence to check proof of implementation. CERT-In must issue alerts faster, and government funding for shared security services would help colleges with no cyber trained staff. 

Indian higher education is going digital at a fast pace, resting on the IT infrastructure of servers, vendors and digital certificates. Someone must keep them secure. Institutions that treat cyber security as a shared and audited responsibility, rather than leaving it to IT personnel, will be the secure ones that never have to bear the brunt of cyber security breaches, that are bound to go up, in the days to come . 

(Prof O R S Rao is the Chancellor, ICFAI University Sikkim. Views are personal.)