ShinyHunters exploit Grav CMS path traversal to breach Clop leak site

Sat, 26 Sep 2026 14:58:08 +0000

Engineer — Act: An unauthenticated path traversal in Grav CMS was exploited in the wild — if you run Grav CMS on any public-facing server, audit your version and apply the latest patch immediately to close this pre-auth attack surface.
SOC/IR — Learn: Confirms ShinyHunters actively weaponizes web CMS vulnerabilities, but the item provides no IOCs or ATT&CK-mappable TTPs applicable to enterprise defenses — useful actor context, no hunt action required.
Leader — Skip

Grav-Cms on CuraSec