Australia warns of global campaign targeting vulnerable CMS platforms

1. Executive summary

The Australian Cyber Security Centre (ACSC) has issued an alert regarding a large-scale, global exploitation campaign targeting vulnerabilities in content management systems (CMS) and associated plugins. Threat actors are actively scanning for and exploiting flaws across at least 17 distinct products — predominantly WordPress plugins, but also including Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE — to deploy webshells. The webshells provide persistent access, enabling service disruption, credential theft, additional malware deployment, and lateral movement. EMEA financial services organisations running any of the affected CMS platforms face direct risk of internet-facing server compromise, which can serve as an initial access vector into broader corporate networks. No verified CVSS scores, severity ratings, or CISA-KEV exploitation states were resolved for the listed CVEs in the reference data provided; attribution is unconfirmed.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Reconnaissance — active scanning. Threat actors are actively scanning websites for opportunities to exploit vulnerabilities in CMS software and plugins. The scanning targets internet-facing web servers running identifiable CMS platforms.
2. Initial access — CMS/plugin exploitation. Actors exploit one or more of the listed vulnerabilities (see product table below) to achieve code execution or arbitrary file upload on the target web server. The campaign leverages flaws across multiple CMS platforms simultaneously, suggesting opportunistic rather than targeted exploitation.
3. Persistence — webshell deployment. Upon successful exploitation, actors deploy webshells to the compromised site. Webshells provide persistent access to the server, surviving page reloads and potentially surviving plugin updates depending on placement.
4. Post-exploitation. With webshell access, actors can: disrupt services; steal credentials (CMS admin credentials, database credentials, or credentials stored in configuration files); plant additional malware; and move deeper into the network from the compromised web server.

Affected products and associated CVEs

Additional observations

• The ACSC assesses that the campaign might be supported by AI, which could help actors accelerate attacks and scale exploitation of emerging flaws. This assessment is single-sourced (ACSC via BleepingComputer) and should be treated as an analytical judgement rather than a confirmed fact. No specific AI tooling, model, or TTP evidence was provided to substantiate this claim.
• The GutenKit/Hunk Companion CVE is listed as "likely CVE-2024-9234" — the ACSC itself expresses uncertainty on this mapping. Treat the CVE assignment as provisional.
• No specific threat actor or group has been named. Attribution is unconfirmed. No MITRE ATT&CK actor profile is available in the verified reference data.
• No CVSS scores, severity ratings, or CISA-KEV exploitation states were resolved in the verified reference data for any of the listed CVEs. Do not assume severity or KEV status without further verification.
• The campaign has impacted "many small- to medium-sized Australian businesses" according to ACSC. No specific victim organisations or sectors beyond the Australian SMB segment were named.

4. Mitigation & containment

P1 — Within 24 hours

1. Inventory and exposure assessment. Identify all internet-facing web servers running any of the affected CMS platforms or plugins listed in §3. Cross-reference wp-content/plugins/ directories (WordPress), Craft CMS plugin directories, MaxSite, MetInfo, and Joomla JCE installations against the product list.
2. Hunt for webshells. Search web server document roots for suspicious PHP/other script files. Focus on: - Files in upload directories (wp-content/uploads/, /tmp/, and similar). - Recently modified .php files outside expected plugin/theme directories. - Files with obfuscated content (base64_decode, eval, gzinflate, str_rot13 patterns). - Example find command: find /var/www/html -name "*.php" -newer /var/www/html/index.php -type f
3. Contain compromised hosts. If a webshell is discovered: isolate the affected server from the network immediately; preserve forensic evidence (disk image, web server access logs, error logs); do not simply delete the webshell without investigating for additional malware or credential theft.
4. Block unexpected child process spawning. On web servers, configure EDR or application control to block the web server process (e.g., apache2, nginx, php-fpm, httpd) from spawning unexpected child processes such as shells, interpreters, or network utilities.

P2 — Within 72 hours

5. Apply security updates. Update all CMS core installations, themes, and plugins to the latest vendor versions. For each affected product, check the vendor's advisory for the specific patched version.
6. Remove unused components. Delete or disable any CMS plugins, themes, or components that are installed but not actively required. This reduces the attack surface.
7. Restrict web directory permissions. Make web directories read-only where possible. Specifically: - Set upload directories to prevent execution of script files (e.g., via .htaccess with php_flag engine off or nginx configuration blocks). - Restrict write permissions on CMS core directories to the service account only. - Disable file editing within the CMS admin interface (WordPress: define('DISALLOW_FILE_EDIT', true); in wp-config.php).
8. Restrict access to sensitive directories. Block direct web access to administrative interfaces, configuration files, and backup directories using IP allowlisting or VPN-only access.

P3 — Within 7 days

9. Enable automatic updates. Where supported and tested, enable automatic updates for CMS core and plugins to reduce window of exposure for future vulnerabilities.
10. Implement file integrity monitoring (FIM). Deploy FIM on web server document roots to alert on unauthorised file creation, modification, or deletion.
11. Review and rotate credentials. If compromise is confirmed, rotate all credentials that may have been accessible to the webshell: CMS admin accounts, database credentials stored in configuration files, SSH keys, and any API keys stored on the server.
12. Log monitoring. Ensure web server access logs and error logs are forwarded to SIEM with alerting on anomalous patterns: unexpected POST requests to non-standard PHP files, frequent access to a single PHP file from varied IP addresses, or requests containing shell-like parameters.

5. Indicators of compromise

No indicators of compromise available in the source material. The ACSC alert describes the campaign and affected products but does not provide specific IOCs such as file hashes, webshell filenames, IP addresses, domains, or user-agent strings.

6. Detection

The sources do not provide specific webshell filenames, file hashes, IP addresses, user-agent strings, or distinctive strings. However, the sources do describe behavioural indicators — webshell deployment on CMS platforms and unexpected child process spawning from web servers — that can be expressed as detection rules.

Sigma rule — web server child process spawning (behavioural indicator from ACSC guidance)

title: Web Server Process Spawning Unexpected Child Process
id: AT-2026-07-11-275-001
status: experimental
description: >
  Detects web server processes (apache, nginx, php-fpm, httpd) spawning
  unexpected child processes such as shells or scripting interpreters.
  Consistent with webshell post-exploitation activity as described in
  ACSC alert on CMS exploitation campaign.
author: Adverse Trace
date: 2026-07-11
references:

  - https://www.bleepingcomputer.com/news/security/australia-warns-of-global-campaign-targeting-vulnerable-cms-platforms/
logsource:
  product: linux
  category: process_creation
detection:
  selection_web_server:
    Image|endswith:

      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/php'
  selection_child_process:
    CommandLine|contains:

      - '/bin/sh'
      - '/bin/bash'
      - 'python'
      - 'perl'
      - 'curl'
      - 'wget'
      - 'nc '
      - 'netcat'
  condition: selection_web_server and selection_child_process
falsepositives:

  - Legitimate CMS cron jobs or maintenance scripts
  - Plugin update processes that invoke package managers
level: high

Sigma rule — suspicious PHP file creation in web document root

title: PHP File Created in CMS Upload Directory
id: AT-2026-07-11-275-002
status: experimental
description: >
  Detects creation of PHP files in CMS upload directories, consistent with
  webshell deployment as described in ACSC alert on CMS exploitation campaign.
author: Adverse Trace
date: 2026-07-11
references:

  - https://www.bleepingcomputer.com/news/security/australia-warns-of-global-campaign-targeting-vulnerable-cms-platforms/
logsource:
  product: linux
  category: file_event
detection:
  selection_php_in_uploads:
    TargetFilename|contains:

      - '/wp-content/uploads/'
      - '/uploads/'
      - '/tmp/'
    TargetFilename|endswith:

      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.pht'
  condition: selection_php_in_uploads
falsepositives:

  - Legitimate plugin installation or update writing PHP files to upload directories
level: high

7. Sources

• BleepingComputer — "Australia warns of global campaign targeting vulnerable CMS platforms" — https://www.bleepingcomputer.com/news/security/australia-warns-of-global-campaign-targeting-vulnerable-cms-platforms/ — 2026-07-11

8. Adverse Trace position

This is a high-severity advisory for EMEA financial services organisations running any of the 17 affected CMS products or plugins in internet-facing deployments. The campaign is active, global, and opportunistic — threat actors are scanning for and exploiting known vulnerabilities to deploy webshells, which provide persistent access and a foothold for lateral movement. No CVSS scores, CISA-KEV states, or specific threat actor attribution were available in the verified reference data; the AI-support assessment from ACSC is single-sourced and unconfirmed. The absence of published IOCs limits immediate network-level blocking, so defence must focus on vulnerability remediation, webshell hunting, and behavioural detection. Adverse Trace will monitor for IOC releases from ACSC or partner agencies and issue an update if specific indicators become available. Clients should prioritise the P1 actions in §4 within 24 hours.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.