ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw

Clop's data leak site was compromised because it ran an unpatched version of Grav CMS containing a known, unauthenticated path traversal vulnerability — meaning no credentials were needed to exploit it. This is a textbook failure of patch management: even criminal infrastructure must apply security updates to remain secure, and neglecting to do so exposed Clop's server, source code, plugins, and private keys to a rival threat actor. The incident underscores that path traversal flaws in public-facing CMS platforms are high-severity risks that can be exploited trivially and rapidly once disclosed. Beyond the irony of ransomware operators being ransomed themselves, this case illustrates how private keys and sensitive artifacts stored on internet-facing servers dramatically amplify the blast radius of any compromise.