More than 700 Ghost CMS sites have been compromised through CVE-2026-26980, an SQL injection flaw that allowed attackers to steal admin API keys and inject malicious JavaScript into legitimate university, blockchain, and media sites. The vulnerability was patched in February, but the three-month window between patch and widespread exploitation tells the real story: organizations running content management systems treat upgrades like optional maintenance rather than operational hygiene. The sites affected include Harvard, Oxford, and Auburn universities, which is particularly concerning given that the injected code was designed to deliver ClickFix attacks disguised as CAPTCHA verification prompts. Visitors to these compromised sites were shown fake security warnings urging them to paste Base64-encoded commands into the Windows Run dialog, ultimately delivering malware payloads through what appeared to be trusted institutional domains.
The Ghost attack shares a critical weakness with a separate campaign hitting KnowledgeDeliver LMS deployments in Japan: hard-coded cryptographic secrets shipped in vendor configuration files. In the KnowledgeDeliver breach (CVE-2026-5426), ASP.NET machine keys were bundled into default web.config templates. An attacker who extracted these keys from one installation could forge malicious ViewState payloads that worked against every other system using the same template. The attackers achieved remote code execution, planted Godzilla web shells, and deployed Cobalt Strike through fake security plugin installers. This marks the third ASP.NET machine key exploitation we’ve seen in recent months, after similar compromises of Sitecore and Gladinet products.
Here’s the formula: vendors ship products with shared secrets in deployment templates, expecting customers will regenerate them during setup. Customers don’t. The secrets leak through documentation, breach disclosures, or reverse engineering, and suddenly every installation is vulnerable. These attacks skip the reconnaissance phase entirely. An attacker with a leaked key can scan for vulnerable instances and execute code without customizing exploits or bypassing unique defenses. The economics are obvious—the Ghost campaign hit hundreds of sites, and the KnowledgeDeliver attacks compromised an entire product ecosystem.
The Ghost attackers weren’t just script kiddies running public exploits. They built two-stage JavaScript loaders that pulled payloads at runtime from external infrastructure, letting them swap malware based on victim fingerprinting without touching code on compromised sites. The campaign relied on Adspect, a commercial cloaking service that served clean pages to security scanners while showing ClickFix lures to actual visitors. At least two separate threat groups were involved, sometimes reinfecting the same domains after remediation or overwriting each other’s code to maintain access. One group poisoned sites within 24 hours of initial compromise.
Then there’s the TrapDoor supply chain attack, which published 34 malicious packages across npm, PyPI, and Crates.io over 72 hours starting May 22. The packages targeted developers in cryptocurrency, DeFi, and AI sectors, posing as build tools and security utilities. They used postinstall hooks, malicious build.rs scripts, and remote payload execution to exfiltrate credentials, cloud tokens, and SSH keys. The npm packages ran a shared payload that validated stolen AWS and GitHub credentials through API calls, established persistence via cron jobs and systemd services, and attempted SSH-based lateral movement. The Python packages pulled down remote JavaScript from GitHub Pages, letting the attacker modify behavior without republishing to PyPI. Multi-ecosystem coordination, built-in credential validation, and infrastructure designed for post-deployment updates—that’s where developer-targeted attacks are in 2026.
Organizations need to treat secret rotation as mandatory, not as a hardening checklist item. For any application using shared cryptographic material in default configurations, those keys are already public. If you’re running Ghost CMS, upgrading to 6.19.1 isn’t enough—rotate all previously used admin API keys and audit 30 days of admin API logs for unauthorized changes. For supply chain security, dependency review has to include runtime behavior analysis. Static signatures won’t catch packages that download payloads after installation. The Ghost and KnowledgeDeliver incidents didn’t require zero-days or advanced exploitation. They required organizations to fail at boring operational work: patching within 90 days and not running vendor default secrets in production. That’s still sufficient.