The story is almost too neat — one extortion crew breaking into another's website. ShinyHunters exploited CVE-2026-42608, a path-traversal bug in Grav CMS, to deface Clop's data-leak site: first a stray text file, then a full takeover splashed with an Umbreon logo. They claim they left with source code, plugins, server logs, and the private keys to Clop's onion service. The useful detail for everyone else is the patch gap. Grav fixed this in the 2.0 branch back in April but never backported it to 1.7, and Clop was running 1.7.43. After BleepingComputer passed along the details, the maintainers shipped 1.7.53.4 with the backport. The lesson isn't schadenfreude — it's that an LTS branch which quietly stops getting security backports is a liability, whatever you're running on it.