Ghost CMS Vulnerability Exploited to Hack Over 700 Websites

Multiple high-impact incidents and supply-chain attacks were reported: a Ghost CMS vulnerability was exploited to compromise over 700 websites (including major universities and DuckDuckGo); Laravel-lang packages were poisoned to deliver backdoors and exfiltrate CI secrets; the ‘Megalodon’ campaign infected over 5,500 GitHub repositories via fake commits and malicious GitHub Actions workflows to steal credentials, tokens and keys; Anthropic’s Mythos flagged ~23,000 potential vulnerabilities across ~1,000 OSS projects (many confirmed high/critical); the ‘Underminr’ issue can hide malicious C2/DN