# Australia Warns of Ongoing CMS Exploitation Attacks Webshell threats escalate on WordPress and Joomla systems. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-07-13 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/72931a7d-0ff2-4ee4-80be-320945a337e1 ## Global CMS Threat Australia's cybersecurity agency has issued a warning about a large-scale attack campaign targeting vulnerabilities in WordPress, Joomla and other content management systems. These attacks primarily target SMEs, deploying malicious webshell malware on unpatched systems. ## Attack Methods Cybercriminals scan for 17 known vulnerabilities to infiltrate systems. These include critical flaws like unauthenticated file uploads, remote code execution and server-side request forgery. Popular WordPress plugins like Ninja Forms and Gravity Forms are particularly at risk. ## Webshell Danger Deployed webshells give attackers remote server control. This access can be used for various purposes from website defacement to stealing user data, even enabling broader network attacks. A single vulnerability can jeopardize entire networks. ## AI Impact According to Five Eyes nations, AI technologies are accelerating the speed and scale of cyberattacks. The window between vulnerability disclosure and exploitation is shrinking dramatically, leaving system administrators with less time to patch. ## Immediate Actions Experts recommend checking web directories for suspicious files, reviewing access logs, and investigating root causes rather than just deleting malicious files. Restoring from clean backups before bringing servers back online is crucial. ## Long-term Solutions For lasting protection, making web directories read-only, enabling automatic updates, and blocking unnecessary connections between internet-facing servers and internal systems are advised. Third-party web management services should be alerted about this warning. ## Sources covering this story - https://securityaffairs.com/195208/security/australia-alerts-organizations-to-ongoing-cms-exploitation-attacks.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._