Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

A batch of Security Affairs reports covering active exploitation, large-scale data aggregation, infrastructure takedowns, and vulnerability discovery: attackers are abusing a patched Ghost CMS flaw (CVE-2026-26980) to deliver ClickFix malware across 700+ unpatched sites (including universities); a 340M-onlyfans profile dataset is being sold that appears reconstructed from prior breaches/public data rather than a direct OnlyFans breach; a zero-click WhatsApp takeover is observed against iPhones on iOS 16 allowing account hijacks without linked devices or user interaction; the merchandise siteof