China-based researchers uncover global Ghost CMS hack
PUBLISHED May 25, 2026, 11:18 AM ET
Read, Watch or Listen
More than 700 websites running the Ghost content management system have been compromised through a recently disclosed vulnerability, CVE-2026-26980, according to research by Chinese cybersecurity firm Qianxin XLab reported Monday by SecurityWeek. The flaw affects Ghost versions 3.24.0 through 6.19.0 and allows unauthenticated attackers to read arbitrary database content. Using this access, attackers reportedly obtained Ghost Admin API keys and bulk-edited articles to inject malicious JavaScript loaders enabling ClickFix social engineering attacks. Impacted sites are said to include properties linked to DuckDuckGo, Harvard University and Oxford University. The issue is patched in Ghost version 6.19.1, according to the National Vulnerability Database.
By James Porter | JQJO News
Timeline of Events
- May 7 Qianxin XLab detects page poisoning
- May 7 Investigation links multiple Ghost sites
- After May 7 Attackers harvest Ghost Admin keys
- After May 7 Malicious JavaScript loaders injected
- Recent weeks Over 700 Ghost sites compromised
- Recently NVD rates vulnerability high severity
- Recently Ghost fixes flaw in version 6.19.1
- Monday SecurityWeek publishes Qianxin research findings
News Intelligence
- Your favorite websites could be at risk. Over 700 sites, including DuckDuckGo and university pages, were compromised. Hackers used a flaw in Ghost CMS to read database content and inject malicious code. If you use these sites, your data could be exposed.
Comments