ShinyHunters breaches and defaces Clop’s leak site
Visitors will need to switch to Clop’s replacement onion address when the old domain is retired.
ShinyHunters breached and defaced Clop’s Tor leak site by exploiting an unpatched Grav CMS path-traversal flaw; Clop has moved to a new onion address and plans to retire the old one after a brief overlap. ShinyHunters says it took material from the server, but Clop says the host held only site content, not operational or financial data. Grav identified the bug as CVE-2026-42608, a core-level vulnerability fixed for Grav 2.0 in 2.0.0-beta.2, with an advisory published on April 27. Clop’s Grav 1.7.43 installation remained exposed because the fix had not reached the 1.7 branch. Grav has since backported the repair in version 1.7.53.4 and urges 1.7 users to upgrade; current 2.x releases were already protected.
Why it matters
For people tracking Clop’s disclosures, the breach leaves the scope of any stolen material unresolved: ShinyHunters says it took material, while Clop disputes that operational or financial data was exposed. The address change also means the old site will no longer be a lasting point of access.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.