Ghost CMS Under Siege: How a SQL Injection Turned 700+ Blogs Into Malware Distribution Networks

A critical unauthenticated SQL injection (CVE-2026-26980, CVSS 9.4) in Ghost CMS was weaponized in a large-scale campaign that compromised over 700 domains — including university and corporate properties — by stealing Admin API keys and injecting malicious JavaScript that uses a fake Cloudflare prompt (the 'ClickFix' technique) to trick visitors into executing malware; a patch (6.19.1) was available in February 2026 but many self-hosted sites remained unpatched.