Grav CMS

Reported Context (5)

On September 18, 2026, ShinyHunters abused a flaw in the Grav content management system (CMS) behind the Clop ransomware gang’s Dark Web leak site and defaced it. September 2026 Cyber Roundup: FBI Breach Claim, Clop Hijack and Major Data Exposures
hijacking the darknet website of a fellow cybercriminal outfit, Cl0p, by exploiting an unpatched flaw in Grav CMS and its hack of the FBI’s “apply.fbijobs[.]gov” portal, stealing around three terabytes of sensitive Suspected ShinyHunters Member Reportedly Detained in Jordan, Cooperating With FBI
Tor address after its previous server was compromised and defaced by ShinyHunters through an unpatched Grav CMS flaw that’s now assessed to be an unauthenticated path traversal vulnerability (CVE-2026-42608). Weekly Cybersecurity Roundup: Suspected $387M Bitget Hack, Exploited Citrix Flaws and More
Clop moved its data leak site to a new Tor address after its old server was defaced by ShinyHunters through an unpatched Grav CMS path traversal flaw. ShinyHunters Defaced Clop Leak Site Through Grav CMS Path Traversal Flaw
ShinyHunters used an alleged Grav CMS file upload flaw to access Clop’s leak site. ShinyHunters Defaces Clop Leak Site, Claims Theft of Server Data and Onion Keys

CVE (10)

Malware (9)

People (14)

Threat Actors (22)

MITRE ATT&CK (4)

Vendors (16)

Products (11)

Tools (11)

Industries (9)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.