Hackers Exploit Ghost CMS CVE-2026-26980 to Poison 700 Websites With ClickFix Malware

**Executive summary:** A high‑risk unauthenticated SQL injection in Ghost CMS (CVE-2026-26980) was weaponized in the wild to steal Admin API keys and poison over 700 websites (including universities) with malicious JavaScript that cloaks traffic, lures users into executing commands via a fake Cloudflare verification page, and ultimately installs a data‑stealing Trojan (ClickFix/UtilifySetup); researchers provide IoCs and recommend immediate patching, credential rotation, log auditing, and content scans.