The researcher reported it through responsible disclosure. The university’s IT team confirmed the server had been running an unpatched version of a file manager that was decommissioned five years prior but accidentally left online. The dork had uncovered what traditional scanning missed.