OP/author here! Apologies about the malware and captcha. It looks like my site was exploited by CVE-2026-26980 affecting all Ghost sites pre v6.19 [1][2] An API key was hijacked to inject malicious JS into every page that looks like a cloudflare captcha; it seems that the JS only targeted windows users, so I didn't catch it before I shared the post widely.
The site has been upgraded to 6.44 to close the vulnerability, I rotated every API key and account credential, and both manually and programmatically scrubbed every instance I could find of the code injection across the database. I think we're clear now!
Sorry to anyone caught by this and thank you to folks for flagging it (and thanks to the HN team for letting me follow up on this after comments were closed). I'm seriously mortified. X_X
[1] https://github.com/TryGhost/Ghost/security/a
TryGhost
Ghost
TypeScript2013–2026
TryGhost / Ghost
Ghost
Independent technology for modern publishing, memberships, subscriptions and newsletters.
58Distinct people
62Mentions
1Explicit recommenders
55.8KGitHub stars
What to know before exploring
What it is
Independent technology for modern publishing, memberships, subscriptions and newsletters.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
Hello, my Namesake, my recommendation is Jekyll, I love Jekyll for freedom and simplicity. I posted on my blog about Jekyll:…
modinfo used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year62 dated mentions
Observed mentions: 2013-10-14 12:03:28 UTC to 2026-06-06 01:32:52 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 7 | 1 | 6 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 11 | 2 | 9 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Ghost.org •
Forum •
Docs •
Contributing •
Twitter
NoteLove open source? We're hiring! Ghost is looking staff engineers to join the team and work with us full-time
The easiest way to get a production instance deployed is with our official Ghost(Pro) managed service. It takes about 2 minutes to launch a new site with worldwide CDN, backups, security and maintenance all done for you.
For most people this ends up being the best value option because of how much time it saves — and 100% of revenue goes to the Ghost Foundation; funding the maintenance and further development of the project itself. So you’ll be supporting open source software and getting a great service!
Quickstart install
If you want to run your own instance of Ghost, in most cases the best way is to use our CLI tool
npm install ghost-cli -g
Then, if installing locally add the local flag to get up and running in under a minute - Local install docs
ghost install local
or on a server run the full install, including automatic SSL setup using LetsEncrypt - Production install docs
ghost install
Check out our official documentation for more information about our recommended hosting stack & properly upgrading Ghost, plus everything you need to develop your own Ghost themes or work with our API.
Contributors & advanced developers
To contribute to Ghost, start with the
contributing guide. To work on the monorepo, see the
codebase documentation.
Ghost sponsors
A big thanks to our sponsors and partners who make Ghost possible. If you're interested in sponsoring Ghost and supporting the project, please check out our profile on GitHub sponsors ❤️
DigitalOcean • Fastly • Tinybird • BairesDev
Getting help
Everyone can get help and support from a large community of developers over on the Ghost forum. Ghost(Pro) customers have access to 24/7 email support.
To stay up to date with all the latest news and product updates, make sure you subscribe to our changelog newsletter — or follow us on Twitter, if you prefer your updates bite-sized and facetious. 🎷🐢
License & trademark
Copyright (c) 2013-2026 Ghost Foundation - Released under the MIT license.
Ghost and the Ghost Logo are trademarks of Ghost Foundation Ltd. Please see our trademark policy for info on acceptable usage.
Read the full README on GitHubWhat Hacker News says
62 sourcesIn Good Careers at Bad Companies
Sidenote: If you're curious, this blog was created using Ghost: <https://github.com/tryghost/ghost>
In Successful people set constraints rather than chasing goalsIs there a particular stack you prefer?
If JS, maybe consider Astro (for simple blogs)? It has built-in MDX support and deploys in a few seconds.
There's also Ghost, but it's a bit more complex. It has both a paid cloud version now and also the FOSS self-hosted version: https://github.com/TryGhost/Ghost
If PHP, maybe https://getgrav.org/?
For Go or a prebuilt binary, maybe https://gohugo.io/?
In Ask HN: Do you still self-host a blog? What's your publishing stack?There is Ghost at least: https://ghost.org/ https://github.com/TryGhost/Ghost
However, it has recently shifted to more limited audience. (payed subscription-based content with different tiers)
In WordPress Is in TroubleThat list isn't deep enough. These are CMS alternatives, not WordPress alternatives.
I need a WordPress alternative to/with the following requirements:
- self-hostable
- opensource core (paid plugins are not a problem)
- so it can be installed and intensively tested without shelling too much money just for R&D
- has ACF equivalent
- has a visual composer à la Gutenberg, a middle-ground between WordPad editing interface and Divi/Elementor
- so the marketing/press department can push content fast
- REST API
- to hydrate stuff
- optional: needs to have been around for 5 years
- optional: needs to still be around in 5 years
Ghost has no ACF apparently (https://forum.ghost.org/t/custom-fields-for-posts/1124/46 and https://github.com/TryGhost/Ghost/issues/9020) and Astro is too custom as of now and I don't want another Gatsby (too shor
Read the rest
t-lived).
It seems that people pay for Ghost, https://github.com/TryGhost/Ghost
In The Static Site ParadoxThis response from one of the Tea developers seems disingenuous https://github.com/TryGhost/Ghost/pull/19743#issuecomment-19...
How could they not have predicted this outcome?
In Tea.xyz causes a flood of spam pull requests to open source projectsTea.xyz causes a flood of spam pull requests to open source projects
46 points · Open discussionI'm a big fan of Ghost for new blogs https://github.com/tryghost/ghost
In A new blog for 2024I quite like them in GitHub release descriptions, e.g. those by Ghost CMS https://github.com/TryGhost/Ghost/releases/tag/v5.52.0
In Terminal Support for EmojiDid you https://github.com/TryGhost/Ghost ?
In Show HN: Primo – a visual CMS with Svelte blocks, a code editor, and SSGYou can! They are focussing on their publishing platform, but it's open source https://github.com/TryGhost/Ghost, see the self hosting guide https://ghost.org/docs/install/
Edit: I see you mentioned no self hosting in an other comment, then it might not make sense for you as the hosted version is indeed paid.
In Ask HN: Simplest CMS for blog type websiteDemanding is a bit strong, it's a reasonable request! If you're not happy with it, you're welcome to not contribute, or to fork and share contributions there instead.
I do think this example is a bit long and hard to read though. Most I've seen for projects tend to be much simpler: "I promise that this is really my work, that I have legal rights to share it, and I give the project this code to use as they see fit with no warranty etc". For example: https://github.com/TryGhost/Ghost/blob/main/.github/CONTRIBU.... And CLA Assistant is great for this if you're using Github, it's super quick & easy.
Of course it doesn't matter if you're building a small library yourself, but as soon as there's a real business associated anywhere, it's helpful to have contributions clearly documented, and to have clear control over the licensing of code within
Read the rest
your projects.
I have about 13 years of experience in the JS ecosystem which I think is long enough to formulate some decent theories :D
> Oh, and the current LTS version is 18, so good luck with security.
NodeJS 16 EOL is September 11th, 2023 - https://nodejs.org/ar/blog/announcements/nodejs16-eol/
Ghost has just finished adding support for v18 https://github.com/TryGhost/Ghost/issues/16059
A good question is why is ghost so conservative about accepting new LTS versions to support. If I had to guess I'd say the answer is probably that the conservativism was induced by the great ES6 module breakages of previous node major versions, which in turn were induced by poorly thought out features in the ES6 module system which led to a bad transition experience for a variety of reasons (toplevel await, extension requirements derived from browser requirements re
Read the rest
sulting wiht typescript extension compatibility issues, etc).
So there were systemic problems with the way the JS language and browsers developed. Essentially, the browser (JS) ecosystem was left in an inadequate state to support web applications for far too long. This in turn is causing ripple waves of technical debt far into the future.
Stagnation in paying off techinical debt leads to workarounds (e.g. CommonJS, callbacks) which then get built on top of. Then when the "standard" is finally introduced (ES6 modules, promises) its already too late and a lot of the "buildings" built on top of those foundations become unstable or even collapse.
The combinatorial explosion of unstandardized and standardized things that need to be supported by foundational tools is also partly to blame. For example, thanks to the unaddressed shortcommings of CSS we have a smorgasbord of semi-adequate CSS solutions with poor compatibility. This in turn leads to problems for bundlers trying to support all kinds of combinations of those, and so on.
So the answer IMO is "technical debt induced by historically poor standardization efforts"
I like posts like this, because software with these properties does deserve to be roasted. It seems like no one can figure out or remember anymore what's wrong with it, though. It's a valid question.
But a couple clarifications.
I don't develop or distribute software that depends on Node, but I imagine deciding which versions of Node to support, or conversely require, for software like Ghost, is a bit like deciding which Java VM versions to support, or which browsers to support. That is, there is a lot of compatibility between Node versions, but do you just develop and test on the latest one, or do you make an effort to support more/older versions? In this case, Ghost seems to be tested on v12, v14, and v16. The author seems to mistakenly think that only the "Active LTS" version of Node gets security fixes, but that's not the case, v
Read the rest
14 and v16 are in "Maintenance LTS" and receive security fixes. That said, their "ends of life" are in April and September of this year, for whatever that's worth. At the end of the day, I think it is considered easy to update and/or run multiple versions of Node. I'm don't know why an app written for Node 16 wouldn't work with a newer Node 18, though, that kind of stuff annoys me sometimes.
For the MariaDB support, I googled and found this note from the Ghost devs: "Note: MariaDB is not an officially supported database for Ghost. It just happened to work given the similarities with MySQL, but we optimize and test for MySQL 5 and 8. As of Ghost 5.0 we are clarifying that official support is purely for MySQL8 in production so that we can double down on DB optimizations." Maybe that's what we're talking about? https://github.com/TryGhost/Ghost/issues/14446
Now, the deeper trend that I think is misguided is the rate of iteration and breaking changes, and apps and libraries having too many dependencies. The problems propagate through the dependency graph. Someone releases a library, and then adds a bunch of features, and then rewrites it, adds features, rewrites it again. That's fine for some hobby project that no one is using. I think anything I say won't be appreciated by someone who hasn't experienced programming and computing any other way, e.g. writing Java applications in the 1990s and 2000s. Or even just using desktop applications in the 90s. Software used to sort of "mature" and then continue to be used and supported, while staying pretty much the same, for years. It wasn't constantly rearranged to use new versions of things that are constantly rearranged to use new versions of things that are constantly rearranged etc. etc. etc.
Showing the 15 most recent of 62 sources. Enable JavaScript to search and browse every indexed mention.