Ghost CMS Flaw Used to Compromise More Than 700 Websites
Summary
Qianxin says attackers exploited patched Ghost CMS SQL injection CVE-2026-26980 to obtain Admin API keys and alter sites with JavaScript loaders for ClickFix attacks; it identified over 700 compromised websites.
Key points
- CVE-2026-26980 is an SQL injection vulnerability in Ghost CMS that was patched in February; SentinelOne said it could allow unauthenticated attackers to extract sensitive database information.
- Qianxin reports mass exploitation of unpatched Ghost instances.
- Attackers reportedly obtained sites’ Admin API Keys and altered articles by injecting malicious JavaScript loaders designed for ClickFix attacks.
- Qianxin identified more than 700 compromised websites, including sites belonging to DuckDuckGo, Harvard University, and Oxford University.
- Qianxin said nearly half of the affected sites were personal blogs or independent sites, with others spanning technology, software development, AI, and cryptocurrency.
- Qianxin reported that at least two groups were conducting the operations and that some sites received different malicious code from competing actors within a day.
- Qianxin said it notified many victims, but most did not respond.
Article Details
- Victim Organization
- More than 700 Ghost-powered websites, including sites belonging to DuckDuckGo, Harvard University, and Oxford University
- Incident Type
- Mass exploitation of CVE-2026-26980 against unpatched Ghost CMS instances to obtain Admin API keys and inject malicious JavaScript loaders into site articles.
- Data Types Exposed
- Ghost Admin API keys
- Affected Records
- More than 700 websites were reported compromised; no record count was provided.
- Operational Impact
- Attackers altered articles on compromised websites by injecting malicious JavaScript loaders designed for ClickFix attacks. Qianxin said some sites received different malicious code from competing groups within a single day.
- Claim Status
- confirmed
MITRE ATT&CK
CVE
Products
Industries
CryptocurrencyAn analysis showed that nearly half of the hacked websites are personal blogs and independent sites, but dozens belong to software development and tech blogs, AI, cryptocurrency, and various other types of entities.PublishingGhost is a widely used open source CMS designed specifically for blogging, newsletters, and publishing, offering built-in tools for memberships, subscriptions, and audience monetization.