Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

This collection of stories describes multiple high-impact active threats and supply-chain incidents: a large-scale campaign exploiting a critical Ghost CMS SQL injection (CVE-2026-26980) to inject JavaScript and drive ClickFix attack flows; a Laravel Lang package supply-chain compromise distributing credential-stealing malware via abused GitHub tags/Composer; Trend Micro warning of an Apex One zero-day used in Windows attacks; and reports of Drupal SQLi, Ubiquiti UniFi OS, and Cisco Secure Workload maximum-severity flaws being patched or actively targeted. Other notable items include law-enfor