Cybersecurity
Clop moves leak site after Grav CMS breach
Clop said it shifted its Tor leak site after ShinyHunters compromised the old server through a Grav CMS flaw that Grav later confirmed and backported to the 1.7 branch.
- Clop said it had opened a new onion address and would keep the old one available briefly before retiring it.
- ShinyHunters said it had broken into the previous server earlier in the month, defaced the site, and taken source code, plugins, server logs and private keys.
- Clop denied any relationship or talks with ShinyHunters and said the server contained only site content.
- Grav confirmed the reported flaw, identified it as CVE-2026-42608, and said it had been fixed in Grav 2.0 and backported to Grav 1.7.53.4.
Clop said it had moved its leak site to a new Tor address after the earlier server was compromised and altered. ShinyHunters had first posted a small text file and then replaced the page with its own logo and a link to its leak site.
ShinyHunters said it had taken source code, Grav plugins, server logs and the private keys for Clop’s onion service, then demanded payment. Clop denied any contact with the group and said it had never shared information with it.
Clop also said its Grav installation had not been fully updated, but said the server held only content and no operational or financial records. It said the other group had later been removed from ShinyHunters’ leak site, which it said often happened during talks.
ShinyHunters described an unauthorised file upload weakness in Grav 1.7.43 and said a form identifier could be used to force writes outside the intended directory. After BleepingComputer shared the details, Grav confirmed the description, named the issue CVE-2026-42608 and released 1.7.53.4 for the 1.7 branch after fixing 2.0 earlier this year.
Named in this story
Organisations
- Clop
- said it had moved its leak site to a new Tor address and denied contact with ShinyHunters
- ShinyHunters
- said it breached and defaced Clop’s site and claimed stolen files
- BleepingComputer
- shared the technical details with Grav and asked the parties for comment
Products and systems
- Grav CMS
- confirmed the flaw, fixed it in 2.0, and backported the patch to 1.7.53.4
How the source tells it
The piece was mostly neutral and source-led, with the threat actors’ claims and Grav’s confirmation reported without editorial flourish.
No emotive framing was found in the original.