Australian government security experts have warned content management system (CMS) customers of a “highly scaled” effort to scan for and exploit vulnerabilities in their products.

The Australian Cyber Security Centre (ACSC) said in an update on July 9 that many SMBs in Australia were affected, although the campaign is global in nature.

“As part of this campaign, malicious cyber actors are actively scanning websites for opportunities to deploy webshells, leveraging various vulnerabilities affecting CMS software and plugins,” the ACSC explained.

“These vulnerabilities primarily allow unauthenticated file upload, remote code execution, server side request forgery or deserialization.”

Read more on CMS threats: CMS Provider Sitecore Patches Exploited Critical Zero Day.

The webshells and subsequent remote access to CMS instances could enable threat actors to deface websites, capture user credentials, upload malware, or use web server access for broader network compromise.

Most of the CVEs being exploited are from 2025 or 2026, with affected products including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS and Joomla JCE.

The ACSC claimed that the rapid scanning and exploitation of CVEs in CMS systems could indicate use of offensive AI-powered tooling.

The Five Eyes intelligence agencies released a rare joint statement late last month warning that frontier AI will “fundamentally” transform the threat landscape “within months.”

Advice from the ACSC

The ACSC urged website owners to check their servers for signs of compromise and remediate by:

• Inspecting the CMS for webshells and vulnerable plugins
• Examining web access logs for IP addresses making GET or POST requests to any webshell paths
• Treating servers with webshells as compromised, isolating them, auditing authentication, and checking network logs for malicious events
• Tracing historical web requests linked to initial exploitation and deployment of webshells
• Reviewing network logs for traffic linked to malicious IP addresses
• Investigating logging and hosts for evidence of persistence, lateral movement or other malicious actions. This could include new accounts, exfiltration attempts or malware deployment
• Patching vulnerable systems to prevent reinfection, and removing or quarantining webshells or other malware
• Restoring compromised websites from recent known-good backups

The notice also urged CMS owners to proactively improve the security of their websites by keeping software up to date, monitoring/blocking file creation, restricting file and path access, monitoring for new processes, and limiting broader network compromise.