Ghost CMS Critical SQL Injection Exploited in Massive ClickFix Campaign
Threat researchers uncovered a large‑scale campaign abusing CVE‑2026‑26980, a critical SQL injection flaw in Ghost CMS (CVSS 9.4), to steal admin API keys and inject malicious JavaScript that triggers ClickFix attacks. Over 700 sites, including Harvard, Oxford and DuckDuckGo, were compromised, highlighting the need to upgrade to Ghost 6.19.1 and rotate keys.