ShinyHunters broke into Clop’s data-leak site and forced the ransomware gang to move to a new Tor address. Grav CMS confirmed the attack used CVE-2026-42608, a path traversal flaw in Grav’s form upload handling that affected Grav 1.7.43 and was fixed earlier in Grav 2.0. ShinyHunters said it used crafted form parameters, including __unique_form_id__, to write uploaded files outside the intended temporary directory and claimed it stole source code, plugins, logs, and Tor private keys.
Why it matters: This shows a real-world exploitation path for a Grav CMS flaw, so anyone running older Grav installs should verify their version, review exposure, and update immediately. It also highlights that even criminal infrastructure can be compromised through unpatched web applications, which is a warning for any internet-facing Grav deployment.
Lawrence Abrams
2026.09.25
100% relevant
This article establishes the story by tying a named CVE and vendor confirmation to a specific in-the-wild exploitation event involving ShinyHunters’ compromise of Clop’s Grav-powered leak site.
← Back to all stories