Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

Multiple high-impact incidents and active exploits reported: a critical Ghost CMS SQL injection (CVE-2026-26980) is being exploited in a large ClickFix campaign to inject malicious JavaScript; Laravel Lang localization packages were hijacked via GitHub tags to distribute credential‑stealing malware through Composer; Trend Micro warned of an Apex One zero‑day actively exploited in the wild and Drupal is being targeted for a critical SQLi. Vendors (Ubiquiti, Cisco) patched maximum‑severity flaws, Google accidentally exposed details of an unfixed Chromium RCE issue, and Chinese actors deployednew