A missing theme exposed a nine-day-old breach across two self-hosted Ghost sites. A field report on CVE-2026-26980: what the attacker got and didn't, surgical decontamination, and the MariaDB-to-MySQL 8 / Ghost 6 migration that followed.