Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

Multiple high-impact campaigns and vulnerabilities were reported: a large-scale exploitation of a critical Ghost CMS SQL injection (CVE-2026-26980) is being used to inject malicious JavaScript and enable ClickFix attack flows; Laravel Lang packages were hijacked via GitHub tags to distribute credential‑stealing malware through Composer (supply‑chain compromise); active zero‑day exploitation was reported against Trend Micro Apex One and other vendors issued emergency patches (Ubiquiti UniFi OS, Cisco Secure Workload); Google accidentally leaked details of an unfixed Chromium issue with RCE risk