Seven seconds: how CVE-2026-26980 extracted my Ghost admin key while I was asleep
On the night of 13 April 2026, between 22:21:20 and 22:21:27 UTC, someone — or more accurately, some script — extracted the admin API key from my self-hosted Ghost blog. The entire exfiltration took seven seconds. I was asleep. By the time I looked at the logs the
