Ghost CMS under attack by CVE 2026 26980 steals keys admin and directs scams with foot this command

A massive campaign is exploiting a critical vulnerability of SQL injection in Ghost CMS (CVE-2026-26980) to steal administrative keys and plant malicious JavaScript in articles, in order to orchestrate clickFix-type scams that induce victims to run commands on their team. The failure affects Ghost versions 3.24.0 to 6.19.0 and allows non-authenticated attackers to read arbitrary data from the base and extract the keys from the Admin API, which in turn serve to modify content and themes from the compromised sites.

XLab researchers at Qianxin documented more than 700 affected domains in different sectors - from universities and media to IA companies, fintech and personal blogs - and indicated that sites with malicious code would include high-profile platforms. The attackers don't just inject a loader. JavaScript light, but charge a second stage that fakes visitors and only delivers the scam to specific targets reducing the likelihood of detection and increasing the impact on specific victims.

The flow of the scam starts with a pop-up page that simulates a legitimate warning (for example, a Cloudflare request) and ends up asking the user to stick a command in the Windows system symbol. That command downloads and runs payloads ranging from DLL loaders and JavaScript droppers to an Electron-based installer observed by researchers. This technique of "paste-this-command" is dangerous because it makes the victim a technical accomplice to the infection.

Ghost released a correction on February 19 in version 6.19.1; however, many sites did not apply the patch, allowing the campaign to continue to exploit outdated instances. If you manage a Ghost site, the first and most urgent measure is to update to the parcheed version and rotate any administrative key or token that existed before the patch, assuming he could have been engaged.

In addition to the updating and rotation of keys, a comprehensive search for commitment indicators should be conducted: review articles and topics by injected scripts or suspicious iframes, audit changes in the Admin API database and log, and compare theme files with known backup versions. Researchers recommend keeping at least 30 days of call records to the Admin API to be able to rebuild the time line of an intrusion and detect unauthorized editions more reliably. Technical sources and detection patterns have been published by the discoverers and by incident response firms to facilitate sweep and remediation: see Ghost's GitHub notice and CVE's entry into the NVD base for formal details and parking dates Ghost's safety notice and CVE-2026-26980 record in NVD.

For detection and operational response, look for patterns such as Admin API requests from unknown IPs, article editions that introduce remote scripts, hidden iframes and calls to unusual external domains from the files served. EDR / AV tools can identify the payloads the attacker tries to deploy in endpoints; technical reports with IoC and observed techniques have been published by third parties of threats and by response teams as reference for forensic scans and malicious domain blocking analysis and detection by SentinelOne.

If you determine that you were compromised, save evidence before you clean up: database, web server and Admin API records, and disk snapshots. Then proceed to regenerate keys, reinstall or restore from clean backups, and force change of credentials from administrators. Since the campaign includes different actors that sometimes re-infect domains or dispute site control, partial cleaning without key rotation and deep review can result in reinfection.

In terms of medium-term mitigation, in addition to the patch and key management, it implements controls that reduce the abuse surface: CSP policies that limit the load of remote scripts, X-Frame-Options headers to avoid overlapping malicious iphrams, WAFs aimed at blocking known SQL injections and file integrity monitoring. Educates users and operators not to stick unverified commands and promotes the principle of minimum privilege for administrative APIs, so that an exposed key has limited impact in case of flight.

This campaign is a clear reminder of two chronic problems in web security: latency in applying critical patches and excessive confidence in third party components that serve dynamic content. Site maintainers, especially in organizations with public visibility, should incorporate automatic updates or fast parking processes and keep a full and recent copy of their backups out of the production network to be able to recover without paying the price of a long cleaning.

If you need specific technical guides for the inspection of your Ghost installation or response templates to communicate an incident to users and partners, I can prepare an actionable checklist and basic commands to search for injection patterns and external calls on your server; tell me if you prefer a quick approach to technical equipment or a non-technical management-oriented version.