KnowledgeDeliver flaw exploited as a zero-day to install web shells

Multiple actively exploited vulnerabilities and broad-impact incidents were reported. A critical zero-day in the KnowledgeDeliver LMS is being exploited to deploy the Godzilla web shell on compromised servers. A large-scale campaign is exploiting a critical SQL injection in Ghost CMS (CVE-2026-26980) to inject malicious JavaScript (ClickFix flows). CISA has ordered federal agencies to patch an actively exploited SQL injection in Drupal. Separately, ShinyHunters has extorted and leaked data from large targets (7‑Eleven, Charter), a Laravel Lang package supply‑chain compromise distributed a new,