[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foaPqmJidRWpejYRXSeu7b9FOAmYNTrWJMF_kTV-P8UQ":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"5f2c2cd2-2241-4b9e-a103-b0307518acdd","ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw","shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal-flaw-6e342a","The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. [...]","The ShinyHunters extortion gang compromised and defaced the Clop ransomware gang's data leak site by exploiting an unauthenticated path traversal vulnerability in Grav CMS. ShinyHunters claims to have stolen source code, plugins, server logs, and private keys, demanding a ransom from Clop. Clop confirmed the unpatched Grav CMS flaw but disputed the value of the stolen data, stating the server contained only content.","ShinyHunters exploited a Grav CMS flaw to hack and deface the Clop ransomware gang's data leak site.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fshinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal-flaw\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F12\u002F10\u002Fhacker-box.jpg","2026-09-25T20:57:55+00:00","2026-09-25T22:00:31.626955+00:00",8,[17,20,22],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"Clop",{"name":23,"type":24},"Grav CMS","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":25,"icon":27,"name":28,"slug":29},null,"Threat Intelligence","threat-intelligence",[31,36,41,46],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":25,"icon":27,"name":28,"slug":29},[49],{"type":50,"value":51,"context":52},"cve","CVE-2026-42608","Unauthenticated path traversal vulnerability in Grav CMS exploited by ShinyHunters.",[23],{"controls":55,"vendors":142},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":29,"name":115,"problem":116,"products":117},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":158},"unpatched-grav-cms-flaw-lets-shinyhunters-hack-clops-leak-site","Unpatched Grav CMS Flaw Lets ShinyHunters Hack Clop's Leak Site","Clop's data leak site was compromised because it ran an unpatched version of Grav CMS containing a known, unauthenticated path traversal vulnerability — meaning no credentials were needed to exploit it. This is a textbook failure of patch management: even criminal infrastructure must apply security updates to remain secure, and neglecting to do so exposed Clop's server, source code, plugins, and private keys to a rival threat actor. The incident underscores that path traversal flaws in public-facing CMS platforms are high-severity risks that can be exploited trivially and rapidly once disclosed. Beyond the irony of ransomware operators being ransomed themselves, this case illustrates how private keys and sensitive artifacts stored on internet-facing servers dramatically amplify the blast radius of any compromise.",[148,149,150,151,152,153,154,155,156,157],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 12: Network Infrastructure Management","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-28: Protection of Information at Rest (private keys)","NIST RA-5: Vulnerability Monitoring and Scanning","NIST AC-3: Access Enforcement","OWASP Top 10: A01 – Broken Access Control (Path Traversal)","NIST CSF: ID.AM (Asset Management), PR.IP (Information Protection Processes)",{}]