Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks

Background On May 7, 2026, XLab detected a poisoning incident targeting Ghost CMS belonging to one of important clients. The attacker exploited the high-risk SQL injection vulnerability CVE-2026-26980 in Ghost CMS to obtain the target site's Admin API Key without authorization, and then used the Gh…