Australia warns of a global campaign hitting websites through known CMS flaws

Australia's Cyber Security Centre has warned of a large-scale global campaign in which attackers scan websites and exploit known vulnerabilities in content management systems and their plugins to plant web shells. The affected software spans WordPress, Joomla, Craft CMS, and others, with the flaws typically allowing unauthenticated file upload, remote code execution, or server-side request forgery. Once a web shell is installed, attackers can take a site offline, deface it, steal data stored on the server, or pivot deeper into the network. Many small and medium-sized businesses have already been hit, and the agency notes the campaign may be accelerated by AI, which helps attackers scale exploitation of newly disclosed flaws.

Check

Inventory your public websites and their CMS platforms, themes, and plugins, apply outstanding security updates, remove unused components, and review access and network logs and existing accounts for signs of compromise.

Affected

Organizations running internet-facing CMS platforms like WordPress, Joomla, or Craft CMS with unpatched plugins; attackers automatically exploit known flaws to plant web shells, disproportionately hitting small and medium-sized businesses.

Fix

Patch CMS software and plugins promptly, enable automatic updates where possible, make web directories read-only where feasible, restrict access to sensitive directories, and restore from a known-clean backup if compromise is found.