CVE-2026-26980

Attackers Poison More Than 700 Ghost CMS Sites to Push ClickFix Malware

Exposed Admin API keys from a patched SQL injection let operators turn trusted sites into selective malware distributors using commercial cloaking services.