Over 1,300 University Websites Hijacked: A Digital Disaster Waiting to Happen

A wave of linkjacking attacks has compromised over 1,300 webpages across the University of the Philippines (UP) system, with many redirecting unsuspecting users to online betting sites like 1xbet, Win88, and JILI. What may appear at first glance as a nuisance is, in fact, a stark indicator of deeper vulnerabilities within the university’s digital infrastructure and a warning signal to other institutions operating with similarly fragmented cybersecurity oversight.

These attacks aren’t random. They exploit unprotected file upload mechanisms to plant malicious code, which then creates backdoor access into servers. From there, threat actors can redirect traffic, conceal their presence from system administrators, or even expand their foothold within the broader network. It’s a quiet, calculated form of infiltration one that remains dangerously effective, especially when there is no clear accountability or dedicated cybersecurity unit in place.

The problem is made worse by the structural confusion within UP itself. After the breaches were discovered and reported, a game of finger-pointing ensued: from the IT Development Center (ITDC) to the Data Commons, from campus IT offices to the newly created Office of the Vice President for Digital Transformation (OVPDx). Some campuses quickly resolved affected pages; others were left in limbo. The OVPDx, tasked with leading UP’s digital transformation, has so far emphasized long-term goals but remains vague on immediate cybersecurity steps.

This isn’t just a university issue. Linkjacking and similar exploits are being observed across multiple state universities and government agencies in the Philippines. The damage isn't limited to embarrassment or broken links these vulnerabilities can be used to leak personal data, disrupt services, and erode public trust in institutions that operate on .gov and .edu domains. When even the DICT and major government agencies like PhilHealth and the PNP fall prey to such attacks, it’s clear the national approach remains reactive, underfunded, and scattered.

UP’s proposed P1.2 billion ICT budget for 2026 includes funds for advanced computing infrastructure but doesn’t yet prioritize robust cybersecurity controls. Without a dedicated allocation and proactive initiatives like penetration testing, SOC2 compliance, or comprehensive risk assessments, these investments risk becoming new targets rather than safeguards.

This ongoing crisis illustrates a sobering truth: modern cyberattacks don’t always arrive with fanfare. They sneak in quietly, hijack trust, and exploit our weakest digital entry points. Preventing this requires more than patching websites it demands strategic coordination, specialized expertise, and the political will to prioritize cybersecurity before the damage becomes irreversible.

At Directpath Global Technologies (DGT), we’ve helped both public and private sector clients detect, contain, and prevent these very kinds of breaches. As a Managed Security Services Provider (MSSP), we offer solutions like VAPT, XDR, SOC2 audits, WAF deployment, and vCISO advisory all supported by an AI division that adapts defenses to the specific risk environment of each organization. Whether it's a university protecting student data or a government agency defending national systems, cyber resilience is no longer optional.

The linkjacking of UP’s websites should serve as a national wake-up call. If we treat cybersecurity as an afterthought, the consequences will only grow more severe. It’s time to build the digital walls before another breach knocks them all down. Source: Philippine Collegian