India

Teen Hacker Exposes Flaws in Education Portal, Joins Cybersecurity Team at IIT Kanpur

Thursday, June 11, 2026
5 min read
Teen Hacker Exposes Flaws in Education Portal, Joins Cybersecurity Team at IIT Kanpur

Most job seekers deal with resumes and cover emails. For nineteen-year-old Nisarga Adhikary, it was something different entirely: a blog post exposing holes in the Central Board of Secondary Education’s on-screen marking portal.

That post dropped on May 22nd. It caught some serious attention. Manindra Agrawal, the director at IIT Kanpur, said he reached out to Adhikary right after reading it. Now, this week, the teenager is actually working as an Open-Source Intelligence and threat intelligence engineer over at C3iHub, which is the institute’s tech innovation hub.

Agrawal mentioned it in an interview. He said Adhikary has been slotted into their cybersecurity team. They’ve hired young engineers before. He wasn't sure if Adhikary was the youngest ever recruited there, but he definitely pointed out that he was among the youngest hires IIT Kanpur had made.

The issues Adhikary flagged weren’t just about a website glitch. It fed into a much bigger mess concerning how this marking system was rolled out. Things got rushed. According to reports from the Hindustan Times , there were no bids in the first tender, nothing successful in the second round either. So they relaxed the technical requirements for the third time around. That one went to Coempt Edu Teck.

Further digging by the HT showed something else about that company’s certificates. One of them related to a completely different client using the same software in a pre-production setup. Another certificate? Nearly two years old. It felt shaky, you know?

Adhikary cleared his Class 12 exams this year and now he’ll be working under IIT Kanpur’s security team on a contract basis. What that means is analyzing public data, spotting weaknesses in websites and apps, helping organizations patch those security holes. It sounds intense.

When asked about the move, Adhikary seemed genuinely excited. He said it was the first time he’d been in a security-focused role. Before this, his background was mostly software engineering; cybersecurity felt more like a hobby.

Neither of his parents are in the field. They both work in finance. But that interest in tech runs deep. Adhikary recalled starting to code when he was six or seven. He got seriously into things when he started participating in Capture the Flag competitions back in Class 6. CTF, you know, those gamified hacking puzzles where you hunt for hidden strings flags in vulnerable programs or networks.

About the money side of things? Nobody’s exactly sure about his salary at IIT Kanpur. He did acknowledge it wasn't what he hoped for.

“The pay is decent,” he admitted. “But I was expecting a bit more.” He added that he’s used to working on projects with companies based in the US. There’s just this financial pull, the advantage of earning in dollars because of the USD-INR exchange rate.

Right now? No big plans for further education. He isn't really into academia. He wants to build stuff. Startups. Products people actually use.

Meanwhile, things were happening on the administrative side too. On May 24th, Union Education Minister Dharmendra Pradhan made a directive. IIT Madras and IIT Kanpur were told to send a four-person team of experts in computer systems, processes, and cybersecurity to help CBSE sort out those glitches in its post-result services portal.

Agrawal was part of that exercise. He was stationed at the CBSE headquarters in Delhi, met Adhikary about two weeks ago.

The director still offered some perspective. “Adhikari is obviously talented,” Agrawal said. “But he’s got a lot more to learn and needs to develop those skills further. IIT Kanpur gives him that chance. He’ll do fine if he keeps pushing.”

Back to the initial finding. In his blog, Adhikary had reported those vulnerabilities straight to CERT-In on February 25th. The HT picked up on this in June. He found five major flaws in that marking portal. One was seriously exposed: a master password stored in plain text. That meant users could totally skip two-factor authentication just by reading it.

He reported those issues. CERT-In fixed one flaw after the alert, but the rest? They lingered until the whole system got shut down eventually. It’s a messy process.

Written by Gree News Team — Senior Editorial Board

Gree News Team covers international news and global affairs at Gree News. Our collective of senior editors is dedicated to providing independent, accurate, and responsible journalism for a global audience.

#sensational#india#global#trending

More from India

View All

Latest Headlines