Ghost CMS Vulnerability Exploited to Hack Over 700 Websites
Source SecurityWeek
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 26 May 2026, 22:44 UTC
What to do
AI-suggested
A patch for CVE-2026-26980 was released in February 2026. Site operators should ensure their Ghost CMS installations are updated to the latest patched version to remediate the SQL injection vulnerability. Since the vulnerability is actively exploited in the wild, immediate patching is critical. Additionally, compromised sites should be thoroughly inspected for injected malicious code and cleaned. Operators should rotate any exposed credentials or API keys. No vendor advisory content contradicts these recommendations.
Description
Sites belonging to major universities such as Harvard and Oxford, as well as DuckDuckGo, have been compromised in the attack. The post Ghost CMS Vulnerability Exploited to Hack Over 700 Websites appeared first on SecurityWeek .