CMS Exploitation Campaign Plants Webshells on Business Websites

At a glance

TL;DR

Australia’s cyber agency has warned of a large-scale CMS exploitation campaign. Attackers scan websites and plant webshells through known plugin flaws. Many small and medium Australian businesses have felt the impact.

What happened

ASD’s ACSC issued an alert about global attacks on content management systems. The actors chase public, patchable bugs in CMS software and plugins. According to the ACSC, they are “actively scanning websites for opportunities to deploy webshells.”

Most of the flaws allow unauthenticated file upload, remote code execution, SSRF, or deserialisation. The alert names many WordPress plugins, including Simple File List, Gravity Forms, and Ninja Forms. It also lists Craft CMS, Joomla JCE, MetInfo, and others. Every listed bug is public and already has a patch. Once a webshell lands, the attacker gains remote control of the server.

Who is behind it

The ACSC does not name a group. It refers only to “malicious cyber actors.” So attribution stays low at this stage. The pattern points to broad, opportunistic exploitation rather than one targeted crew.

Impact and scale

This CMS exploitation campaign runs worldwide, the alert says. Compromised servers give attackers several options. They can deface sites, steal user credentials, or push malware to visitors. Web server access can also become a route into the wider network.

Five Eyes agencies link the surge to AI. Their joint statement warns that AI is “accelerating the speed and scale of cyber operations.” As a result, the gap between disclosure and attack keeps shrinking.

How to stay protected

First, patch CMS software and every plugin without delay. Next, check web directories and access logs for odd files or requests. Then, treat any server with a webshell as compromised, and isolate it. Where possible, set web directories to read-only to block new uploads. Also, watch for unexpected child processes spawned by the web server. Finally, restore clean sites from a known-good backup.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.