Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign By Bill Toulas May 24, 2026 10:12 AM A large-scale campaign is exploiting a critical SQL injection vulnerability CVE-2026-26980 in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. …
… Among them is a JavaScript injection following the ‘t.js?site= ’ pattern, where is a unique value assigned to each compromised website. Through analysis, Silent Push discovered more than 80 malicious injection domains and a set of pre-weaponized domains that had not yet been used in attacks. …
… Varonis underscores that familiar, easily contained bugs like SSRF and HTML injection race conditions can now be weaponized into potent attacks when prompt injection is possible. …
… Proactive AI Pen Testing: Stress-test assistants and agents for vulnerabilities such as prompt injection and jailbreaks. In addition, Varonis Atlas can stress-test assistants and agents for vulnerabilities such as prompt injection and jailbreaks. …
… They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold. …
… Over half of AI prompt inputs are sent to personal accounts, and 23% of sensitive prompt uploads involve data transiting through personal or unverified accounts i.e., outside the reach of any corporate DLP policy or logging infrastructure , conveying the real risks of AI usage. …
… They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold. …