UNIVERSITY WEBSITES HIJACKED TO SERVE PORNOGRAPHY
INDUSTRY DESK■ 1 MIN READ
FRI, APR 24, 2026■ AI-SUMMARIZED FROM 1 SOURCE BELOW
Hundreds of subdomains across dozens of top universities have been compromised by scammers and are now hosting adult content. The breach stems from poor website maintenance and security practices.
Researchers discovered that inactive university subdomains—many tied to defunct projects, old departments, or abandoned initiatives—lack proper oversight and security controls. Scammers exploit this negligence by gaining access and redirecting traffic to pornographic sites, damaging institutional reputation.
The hijacked domains retain authority from their parent university websites, allowing them to rank highly in search results and appear legitimate to users. This makes them valuable real estate for malicious actors seeking to monetize adult content through advertising.
The issue reflects broader challenges in digital housekeeping at large institutions. Universities often maintain thousands of subdomains across departments, research groups, and legacy systems. Without centralized inventory and monitoring, inactive domains become security blind spots.
Expert recommendations include conducting subdomain audits, removing unused domains, implementing security headers, and establishing continuous monitoring. Universities are being urged to treat dormant web properties as potential vulnerabilities rather than harmless digital debris.
■ MORE FROM THE SECURITY DESK
The U.S. State Department has ordered diplomats worldwide to highlight what it characterizes as systematic intellectual property theft targeting American AI laboratories by Chinese companies.
JUST NOW— AI Desk
Home security firm ADT has confirmed a data breach following threats from the ShinyHunters extortion group to leak stolen customer data. The group demanded ransom in exchange for not releasing the information.
JUST NOW— Security Desk
U.S. and U.K. cybersecurity agencies are warning of a custom malware called Firestarter that continues to survive security updates on Cisco Firepower and Secure Firewall devices. The threat targets systems running Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.
3H AGO— Security Desk
Article 9 of the Digital Operational Resilience Act now requires EU financial institutions to implement mandatory authentication and access controls. Non-compliance creates direct regulatory and security exposure.
3H AGO— Industry Desk