CMS Webshell Exploitation Campaign Targeting Australian Businesses

The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) has issued an alert about a large-scale global exploitation campaign targeting content management systems (CMS). Many Australian small and medium businesses have already been impacted, primarily through vulnerable WordPress plugins, but also Joomla, Craft CMS, MaxSite, MetInfo and others.

Malicious cyber actors are actively scanning the internet for vulnerable websites and deploying webshells — small scripts that give attackers remote command and control over the underlying web server. This is not a targeted operation. It is opportunistic, automated, and increasingly accelerated by AI tooling that shortens the window between vulnerability disclosure and mass exploitation to hours.

If you run a WordPress, Joomla or Craft site — even a simple brochure site — you are in scope.

What attackers do once a webshell is deployed

A webshell turns your website into an attacker-controlled endpoint. From that foothold, the actors typically:

• Deface or disrupt the website
• Harvest credentials entered by visitors (contact forms, logins, checkouts)
• Steal data stored on the web server or connected databases
• Upload additional malware to infect legitimate visitors (drive-by downloads, scam pages)
• Use the web server as a beachhead to pivot into your broader corporate network

For an Australian SMB, the practical consequences are Notifiable Data Breach obligations under the Privacy Act, reputational damage, chargebacks from customers hit by scams, and — increasingly — ransomware detonated from that initial web foothold.

The vulnerabilities being exploited

The ACSC alert lists specific CVEs currently being weaponised. The pattern across them is the same: unauthenticated file upload, remote code execution, server-side request forgery, or unsafe deserialisation. In other words, an attacker on the internet — with no login — can drop a file on your server and run code.

Affected software and plugins include:

• WordPress plugins: Simple File List (CVE-2025-34085, CVE-2020-36847), WavePlayer (CVE-2025-12057), BerqWP (CVE-2025-7443), WPBookit (CVE-2025-7852), Ninja Forms (CVE-2026-0740), ThemeREX Addons (CVE-2026-1969), Breeze Cache (CVE-2026-3844), pay-uz (CVE-2026-31843), ACF Extended (CVE-2025-13486), Sneeit Framework (CVE-2025-6389), WPvivid Backup (CVE-2026-1357), Gravity Forms (CVE-2025-12352), GutenKit/Hunk Companion (likely CVE-2024-9234)
• Craft CMS: CVE-2025-32432
• MaxSite CMS: CVE-2026-3395
• MetInfo CMS: CVE-2026-29014
• Joomla JCE: CVE-2026-48907

All of these have patches available. The campaign is succeeding because most SMB websites are not patched within the exploitation window.

Immediate steps if you think you've been hit

Follow the ACSC's remediation sequence — do not skip steps:

1. Inspect the CMS for webshells. Look for abnormal or recently modified files in the web root and, especially, inside plugin directories that match the CVEs above. Attackers often disguise webshells as innocuous PHP files with names like wp-cache.php, theme.php or admin-config.php.
2. Review web access logs. Search for suspicious GET and POST requests to unusual file paths, particularly repeated requests to the same odd .php file from a small number of IPs.
3. Treat any server with an identified webshell as compromised. Isolate it. Audit authentication logs and network logs for signs of malicious activity — not just on the web server, but on any system that trusts it.
4. Trace back in time. Identify the initial exploitation request so you understand which vulnerability was used and whether other systems are exposed.
5. Review edge firewall logs for communication with the attacker IPs. Block them across the environment.
6. Hunt for persistence and lateral movement — new admin accounts, scheduled tasks, unexpected outbound connections, new users in Microsoft Entra ID if the site connects to it.
7. Patch and clean. Apply all outstanding CMS and plugin patches, remove or quarantine any webshells and persistence mechanisms, and only then bring the server back online.
8. Restore from a known-good backup if there is any doubt about integrity.

Hardening your website so this doesn't happen again

Remediation without hardening just resets the clock. The ACSC's guidance, and our own experience across Australian SMBs, points to the same protective controls:

• Patch aggressively. Enable automatic updates for CMS core and plugins where the rollback risk is low. If a plugin has an actively exploited vulnerability and no patch, disable it.
• Move to managed hosting or a cloud service where the provider takes responsibility for rapid patching. This is often the single biggest risk reduction for an SMB running a brochure site.
• Make the web directory read-only where possible. If files cannot be written, webshells cannot be deployed. Where writes are required (uploads, cache), scope them tightly and monitor.
• Restrict file and path access at the web server config level. Explicitly deny execution in upload directories.
• Monitor for new child processes spawned by the web server. A webshell almost always executes shell commands via a child process — blocking or alerting on this catches the attack even when the initial upload is missed. Application control on internet-facing web servers dramatically reduces webshell effectiveness.
• Segment the network. The web server should not be able to freely reach domain controllers, file servers, or finance systems. Limiting east-west traffic contains a compromise to the DMZ.
• If a third party runs your website, forward them the ACSC alert and confirm in writing what they are doing about it.

How Mycelium 365 helps

Most of the Australian SMBs affected by this campaign do not have an in-house cyber team. That is exactly the gap we cover. As a Microsoft-first managed IT and security provider, we can:

• Audit your web presence and hosting, identify vulnerable CMS installs and plugins against the current CVE list, and put a patching cadence in place.
• Deploy Microsoft Defender for Endpoint / Defender for Servers on your web servers to catch webshell activity, anomalous child processes, and post-exploitation behaviour in real time.
• Run 24/7 SOC monitoring through our Huntress-powered managed detection and response, so suspicious activity on your web server is triaged and responded to overnight — not discovered when your site starts serving scam pages on Monday morning.
• Harden Microsoft 365 and Entra ID so that if a web server is compromised, attackers cannot pivot into email, SharePoint, or finance workflows. This includes conditional access, MFA enforcement, and privileged identity management.
• Implement the Essential Eight across your environment — application control, patch management, MFA, restrict admin privileges, and daily backups — which directly addresses the controls the ACSC recommends against this campaign.
• Incident response. If you have already been compromised, we can isolate, contain, forensically review, and rebuild — and help you meet your Notifiable Data Breach obligations.

The joint Five Eyes statement is right: AI is accelerating both sides of this. Vulnerabilities are being weaponised faster than SMB patching cycles can respond. The defensive answer is not more tools — it is a managed environment where patching, monitoring, and response are someone's full-time job.

If you are unsure whether your website is on the affected list, or you want an independent review of your CMS hosting and Microsoft 365 security posture, contact Mycelium 365 for a no-obligation assessment. We support businesses across Melbourne, Sydney, Brisbane, Perth and regional Australia.