November 21, 2023. ownCloud discloses a critical vulnerability rated 9.8 out of 10 for severity. A fix is already included in version 10.13.1.

August 26, 2026. Hunt.io, a threat-intelligence firm that tracks attacker infrastructure, publishes research linking that vulnerability to a reported compromise of a Philippine nuclear research agency. Its researchers found the agency's files on an exposed server associated with the operator.

August 27, 2026. CISA adds the vulnerability to its Known Exploited Vulnerabilities catalog.

More than two and a half years separate the fix from the findings. The case shows how a vulnerability can stay dangerous long after the patch exists, especially on internet-facing systems that nobody is actively maintaining.

What Researchers Found

According to Hunt.io, the operator exploited CVE-2023-49105, a flaw in the ownCloud file-sharing platform. When no signing key is configured, which the default setup allows, an attacker who knows a valid username can make requests that the server accepts as authenticated, and then read, change, or delete that user's files without the password.

Hunt.io found custom scripts that forged pre-signed URLs using an empty signing secret, listed files over WebDAV, and downloaded them with randomized delays between requests, a pattern intended to evade detection. The researchers counted 176 files, about 372 megabytes, staged for collection. A spreadsheet on the server referenced roughly 9 gigabytes marked as taken, but most of that was not on the server examined, so the figure remains unverified.

Hunt.io says it reported the findings to CERT-PH, the Philippines' national cyber response team, before publishing, and held its publication until August 25. That is how responsible disclosure is supposed to work, and it is also a reminder that the people who discover these exposures are usually outsiders, not the organizations affected.

Some caveats matter. The agency has not been named in the public reporting reviewed for this article, and that reporting includes no official statement on the full scope of the incident. Hunt.io describes the operator as likely Chinese-speaking, based on language in code comments and folder names, but says it does not attribute the activity to a named group, and it also considers an opportunistic explanation. The software failure is the lesson here, not the attribution.

What Was Exposed, and Why It Matters

The files Hunt.io reports finding included nuclear-material account records, a research reactor core-component database, radiation safety documents, an authorized user list, and personnel records such as passport-related documents. They also included credential material: a KeePass password database, encrypted files, and a BitLocker recovery key. A 192-megabyte export from an employee attendance system, with records running through December 2024, was staged alongside them.

For any organization, the potential consequences of an exposure like this extend well beyond the files themselves:

  • Sensitive information in the wrong hands. Records about operations and safety, and personal data about staff, can be misused long after the incident.
  • Access to other systems. Credential stores can turn one compromised server into a path to others, which expands the scope of the response.
  • Cost and disruption. Investigating what was accessed, resetting credentials, and rebuilding trust in affected systems takes time and money.
  • Regulatory and reputational risk. A public agency or regulated business faces questions from regulators, partners, and the public about why a known fix was not applied.

These are possible outcomes of an exposure of this kind, not confirmed consequences of this particular case.

The Same Operator Found a Second Victim the Same Way

The same server showed a second victim, a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy. That compromise ran through a different outdated component: a vulnerable version of the LiteSpeed Cache plugin for WordPress, tracked as CVE-2024-28000, which allowed an unauthenticated attacker to gain administrator privileges. Hunt.io also found evidence of password guessing against the site's login interface using the username "admin."

The attacker walked away with a full archive of the website and a database export containing user password hashes and secret keys. Neither organization was a special case. They shared one trait: internet-facing software that was behind on updates. One operator, two unrelated organizations, and whatever was left open.

Why Patch Management Keeps Failing

The Philippine case reflects a wider pattern. Verizon's 2026 Data Breach Investigations Report found that vulnerability exploitation is now the most common way breaches begin, the first time in the report's 19-year history that stolen credentials no longer lead. The same report put the median time to fully patch a vulnerability at 43 days, up from 32 the year before. Mandiant's M-Trends 2026 shows the same pattern from incident-response cases: exploits ranked first among identifiable initial infection vectors at 32 percent, and have led for six consecutive years. Attackers do not wait for patching cycles to finish.

No source explains why this specific agency left the flaw open. But the usual reasons are operational, and familiar to most IT teams:

  • Nobody owns the system. A tool installed years ago for one project keeps running after its owner has moved on.
  • Nobody knows it exists. Asset inventories miss internet-facing tools that accumulated quietly over time.
  • Updates feel riskier than waiting. Patching risks downtime. Skipping it risks nothing visible, until it does.
  • Patching follows the announcement, not the exploitation. A flaw that was serious in 2023 became actively exploited in 2026, and a one-time review never got revisited.

These are process failures, not technical ones. The patch existed. What was missing was an owner, a deadline, and a reason to revisit the decision.

Patching and Testing Do Different Jobs

Organizations need both continuous remediation and periodic independent testing, and neither replaces the other. Patch management keeps known weaknesses closed. Independent testing checks what an outsider can actually reach and exploit, including systems that fell outside the process.

Patching alone also leaves a gap. As TechRepublic's report on the CISA listing put it, patching closes the access path, but only retrospective investigation can show whether attackers used it first. An organization that finds a long-exposed flaw should update and then check its logs for the period the flaw was open.

The Philippine Context: Testing, Remediation, and Verification Together

The Department of Information and Communications Technology has issued Department Circular HRA-008, series of 2026, which, as reported by Newsbytes.ph in September, requires vulnerability assessment and penetration testing annually, after major system changes, and after cybersecurity incidents. The report says it sets remediation targets of five business days for critical findings and 30 business days for medium and low ones, and that it covers national government agencies, government-owned and controlled corporations, state universities and colleges, and local governments, with additional obligations for operators of critical information infrastructure. Whether it applies to a given organization depends on that coverage, so each organization should check the circular itself.

For public-sector IT leaders, the implication is that testing, remediation, and verification are meant to work as one cycle. Testing finds the weakness, remediation closes it on a deadline, and verification confirms that it stayed closed. Compare a five-business-day target for critical flaws with the 43-day median in the Verizon data. The gap between those numbers is where incidents like this one happen. Private organizations are not bound by a public-sector circular, but they face the same attackers and can use the same targets as a benchmark.

What Any Organization Still Deferring Updates Needs to Hear

October is Cybersecurity Awareness Month, and updating software appears on nearly every checklist. Awareness alone is rarely the gap. What tends to fail is the process that connects knowing to doing.

Inventory what is exposed to the internet, including tools that were set up for a project and forgotten. Patch by exploitation, not by announcement: a flaw that lands on CISA's known-exploited list has stopped being theoretical. Name an owner and set a deadline for every internet-facing system. Investigate after patching a system that was exposed for a long time. And test from the outside, because policies describe what should be patched, and only testing shows what is reachable today.

Find the Forgotten System Before an Attacker Does

An outdated file-sharing server or forgotten web application can give an attacker a path to sensitive files, credentials, and potentially other systems.

Secuna Pentest helps organizations identify exploitable weaknesses across web applications, mobile applications, APIs, networks, and cloud infrastructure through manual, scoped penetration testing. Secuna is a DICT-recognized VAPT provider under the D-TAP program. Penetration testing does not replace patch management or continuous monitoring, and it does not guarantee that every forgotten asset is found. It provides an independent view of what an attacker may be able to reach, helping organizations prioritize remediation and verify their controls.

A fix that has been available for years protects nobody until someone applies it. The organizations best placed for what comes next will be the ones that know what they expose, close it on a deadline, and verify that it stayed closed.

To learn more, reach out to our team at [email protected] or explore our services at secuna.io.

Sources: Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities, Hunt.io · CISA Flags Old ownCloud Flaw After Reported Philippine Nuclear Data Theft, TechRepublic · Verizon DBIR: Vulnerability Exploitation Is the Dominant Initial Access Vector, Help Net Security · M-Trends 2026 Report: Attackers Are Handing Off Access in 22 Seconds, Help Net Security · DICT Orders Annual Security Testing for Gov't IT Systems, Newsbytes.ph