Australia is warning website operators of a mass exploitation campaign hitting common content management systems, in the second such alert from the country’s cyber agency in as many months.
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) issued a bulletin warning that threat actors are scanning for known flaws in CMS platforms and plugins in order to deploy webshells and take over sites.
“As part of this campaign, malicious cyber actors are actively scanning websites for opportunities to deploy webshells, leveraging various vulnerabilities affecting CMS software and plugins,” ACSC writes.
The agency says the bugs being exploited allow for unauthenticated file upload, remote code execution, server-side request forgery, or deserialisation — a mix that hands attackers a foothold to remotely command the server once a webshell lands.
ACSC’s alert covers 17 separate vulnerabilities. Most sit in WordPress plugins, though the campaign isn’t limited to WordPress: Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla’s JCE editor are also on the target list.
The cyberroos note that none of this is novel. Every flaw in the bulletin is public, known, and already patched — some fixes going back to 2024. Rather than a new exploit, the campaign leans on site owners who are lax on patching, forget to update their code, or treat WordPress as a set-it-and-forget-it option.
This is ACSC’s second CMS-focused alert in two months. In May, the agency warned that compromised WordPress sites belonging to legitimate Australian businesses were being used in a ClickFix social-engineering campaign to deliver Vidar Stealer malware to visitors. This is a sign the same class of unpatched sites keeps getting reused for different payloads.
The scale tracks with the broader state of WordPress security. SPB reported on a similar case in June, when a critical SQL injection flaw in The Events Calendar plugin left over 700,000 sites exposed.
Patchstack’s 2026 whitepaper counted 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42 percent jump over the year before, with a median gap of roughly five hours between disclosure and active exploitation. Patchstack also found that nearly half of those vulnerabilities had no patch available at the time they went public — a window ACSC’s bulletin is effectively asking Australian site owners to close on their own end, since the flaws it’s tracking already have fixes waiting.
ACSC ties the urgency to a wider warning it co-signed last month. Its bulletin echoes language from a joint statement by the Five Eyes cyber agencies, which said frontier AI is shrinking the gap between vulnerability disclosure and exploitation from years to months.
“The vulnerabilities exploited in this campaign are public and known vulnerabilities, with patches available,” ACSC notes.
Small and medium-sized Australian businesses account for much of the impact so far, according to the agency, alongside a broader set of organisations hit globally.
Patching, in theory, is the fix. In practice, nobody wants to risk knocking their own site offline over an update. Maybe do it over the weekend, when traffic’s thin. Hint hint.
