Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

By Bill Toulas

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. [...]

Read full article at BleepingComputer

More from BleepingComputer

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals 14 hours ago Android malware combo takes out loans and relays victims' credit cards 15 hours ago Hackers exploit critical Adobe Commerce flaw to hijack customer accounts 16 hours ago Hundreds of fake Chrome VPN extensions route traffic through a proxy 18 hours ago Plug and Pwn attack uses fake USB devices for Windows SYSTEM access 21 hours ago