Australia Warns of Global CMS Webshell Campaign

The Australian Cyber Security Centre has issued a warning that will feel familiar to anyone who has run a website for more than five minutes. A global campaign is systematically hunting for vulnerable content management systems, and a decent chunk of Australian small and medium businesses have already been caught up in it.

The playbook is simple. Attackers scan the open web for known flaws in CMS platforms and their plugins, then drop a webshell on anything unpatched enough to let them in. From there, the site is theirs.

What a webshell actually does

A webshell is a backdoor that lives inside your website. It looks like an ordinary file to anyone not paying attention, but it gives the attacker a persistent way back in. Once it's installed they can lift credentials, push more malware to visitors, deface or disrupt the site, or use the compromised server as a jumping-off point into whatever network sits behind it.

It is, in other words, a quiet foothold with very loud consequences. And because a webshell doesn't need to shout to do its job, plenty of victims won't notice for weeks.

Who is being targeted

The ACSC named several platforms showing up in the campaign, including:

• WordPress
• Craft CMS
• MaxSite CMS
• MetInfo CMS
• The Joomla JCE editor

The common thread is not the brand of software but the version. Older, unpatched installs are the target, along with plugins and themes that nobody has updated in a while. If it's exposed to the internet and running last year's code, it's a candidate.

The agency also flagged something worth pausing on: AI is almost certainly speeding this up. Attackers are using it to industrialise the process of finding new vulnerabilities and turning them into working exploits, sometimes within hours of a patch being published. The window between disclosure and mass exploitation keeps getting shorter.

The unglamorous fix

There's nothing exotic about the defence, which is probably why so many sites skip it. The ACSC's guidance is the same advice web hosts have been giving for a decade, only now with more urgency behind it.

• Patch everything. The CMS itself, the active theme, and every single plugin. Turn on automatic updates wherever the platform allows.
• Delete what you don't use. Old plugins and themes still ship code that can be exploited, even if they're not switched on.
• Lock down write access. Where possible, set web directories to read-only so a shell can't be dropped in the first place.
• Watch for surprises. New files appearing on the server that nobody remembers adding are usually the first sign something is wrong.

Campaigns like this are opportunistic by design. The attackers aren't picking targets, they're picking whatever answers back. Sites that stay current tend to get scanned and skipped. Sites that don't become somebody else's infrastructure.

For any business running its own site, or paying someone else to run it, this is a decent moment to ask when the last round of patching actually happened. If the answer is a shrug, that's the story.