Ghost CMS SQLi fuels 700-site ClickFix campaign; FBI flags Kali365 MFA-bypass PhaaS; Laravel-Lang supply chain hits four repos; Operation Saffron seizes First VPN; Ghostwriter targets Ukraine gov; PRC Showboat implant exposed in ME telecom; DBIR 2026 finds patching in freefall.