Mass Webshell Campaign Exploits 17 CMS Flaws, Hits Australian Websites

A sprawling, AI-accelerated exploitation campaign is sweeping through content management systems worldwide, and Australian small and medium businesses are squarely in the blast radius.

The Australian Signals Directorate’s Cyber Security Center (ASD’s ACSC) has issued an urgent alert warning that malicious actors are scanning the internet at scale, hunting for unpatched WordPress plugins, Joomla extensions, and standalone CMS platforms to plant webshells and seize control of web servers.

This isn’t a targeted attack against a single sector. It’s opportunistic, automated, and indiscriminate, which makes it especially dangerous for smaller organizations that lack dedicated security teams.

Mass Webshell Campaign Exploits 17 CMS Flaws

The campaign exploits a mix of vulnerability classes: unauthenticated file uploads, remote code execution, server-side request forgery, and insecure deserialization.

Each of these flaws gives attackers a foothold to drop a webshell, a small script that grants persistent, remote command-and-control access to the compromised server.

Once inside, attackers aren’t just window-shopping. ACSC has observed webshells used for website defacement, credential harvesting from site visitors, malware distribution to unsuspecting users, and as a springboard into broader corporate networks connected to the compromised web server.

At least 17 distinct software products and plugins are implicated, spanning WordPress extensions, Joomla’s JCE component, and CMS platforms including Craft CMS, MaxSite, and MetInfo:

Notably, all of these are public, disclosed vulnerabilities with patches already available, meaning every successful compromise represents a missed patching window, not a novel zero-day.

ACSC’s alert ties directly to a recent joint statement from the heads of the Five Eyes cyber agencies, which flagged that AI tooling is narrowing the gap between vulnerability disclosure and mass exploitation.

“What we’re witnessing isn’t a sophistication problem; it’s a velocity problem. AI hasn’t handed attackers new capabilities; it’s handed them a stopwatch, and defenders are still operating on calendar time,” says one Australian threat intelligence analyst tracking the campaign.

ACSC recommends organizations take these steps without delay:

• Inspect web directories and plugin folders for abnormal or unexpected files
• Review access logs for suspicious GET/POST requests to known webshell paths
• Isolate and treat any server with a confirmed webshell as fully compromised
• Trace logs backward to identify the initial exploitation vector
• Check firewall logs for communication with known malicious IPs
• Hunt for persistence mechanisms, lateral movement, or new malware
• Patch immediately, remove webshells, and restore from known-good backups if compromise is confirmed

Beyond immediate remediation, ACSC urges automatic patching where feasible, disabling actively exploited plugins until fixed, making web directories read-only, restricting file/path access, monitoring for unexpected child processes, and applying application control on internet-facing servers.

Businesses relying on third-party web hosts or developers should forward this alert directly to their service provider and request confirmation of remediation steps.

About the Author

Potheeswaran

Author

Visit Website View All Posts