According to Dark Reading, threat actors breached the Philippines Nuclear Agency by exploiting commodity vulnerabilities in ownCloud. The flaws were old and unpatched, which allowed the attackers to gain initial access to the agency's systems.
The stolen data included reactor databases, personnel records, and credential stores. The incident highlights how even well-known, older vulnerabilities remain a serious risk when organizations fail to apply available patches in a timely manner.
This case serves as a reminder that attackers do not always need sophisticated zero-days; they can often succeed by targeting known weaknesses that have been left unaddressed. For critical infrastructure and agencies handling sensitive data, routine patch management is a fundamental security control.