Loading story…
Australia’s ACSC warned of a large-scale global campaign exploiting vulnerable content management systems and plugins to install webshells on internet-facing web servers, with many small and medium-sized Australian businesses affected. Attackers are scanning for known flaws in WordPress plugins and other CMS platforms including Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE, abusing weaknesses such as unauthenticated file upload, remote code execution, server-side request forgery, and unsafe deserialization.
The implanted webshells give attackers persistent remote access that can be used for website defacement, credential theft, malware delivery, and deeper network intrusion. ACSC said organizations should treat any server hosting a webshell as fully compromised, isolate affected systems, inspect logs for lateral movement and persistence, restore from known-good backups after patching, and reduce future exposure by rapidly applying patches, disabling vulnerable plugins, restricting file creation and execution paths, monitoring child processes, and limiting connectivity between public-facing web servers and internal networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Australia's ACSC warned of a large-scale global campaign targeting vulnerable CMS platforms and plugins, including WordPress plugins and other CMS products, to deploy webshells on internet-facing web servers. The alert said many small to medium-sized Australian businesses were affected and advised organizations to inspect for webshells, isolate compromised servers, restore from clean backups, and patch vulnerable systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcethecyberthrone.in
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcecyber.gov.au
Open sourcecyber.gov.au
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An exposed server tied to the **WP-SHELLSTORM** cybercrime operation revealed tooling, logs, command history, and target lists for a large-scale webshell campaign aimed primarily at **WordPress** sites, with additional targeting of **Joomla** and enterprise Java platforms. Researchers said the group scanned more than **1.4 million domains**, exploited **27 CVEs**—including the Breeze plugin flaw `CVE-2026-3844`—and maintained roughly **5,700 active webshells**, while some analysis put validated compromises as high as **25,195**. The operation used layered implants including BestShell-derived webshells, a **SNOWLIGHT** dropper, and a **VShell** payload disguised as a Linux `kworker` process, then resold access to compromised websites. The exposed infrastructure also linked the operators to a separate campaign against **Nacos** deployments, where they exploited the authentication bypass `CVE-2021-29441` and stole **613 configuration files** from **11 systems** across **nine organizations**. Investigators assessed the activity with medium-to-high confidence as **financially motivated** and likely conducted by **Chinese or Chinese-speaking** operators rather than a state-backed APT, citing Simplified Chinese artifacts, FOFA usage, and overlap between the web and Java intrusion sets. The operators reportedly tried to alter access logs after the server was discovered, but the exposure had already disclosed extensive indicators of compromise and operational details.
Jul 23, 2026
Craft CMS disclosed and patched two **critical** vulnerabilities, `CVE-2025-32432` and `CVE-2024-58136`, that can be chained or abused to achieve **unauthenticated remote code execution** and full compromise of vulnerable servers. The flaws affect Craft CMS `5.x` before `5.6.17`, `4.x` before `4.14.15`, and `3.x` before `3.9.15`; one issue involves insufficient input validation in image transformation functionality, while the other stems from unsafe handling of the `__class` variable in the underlying Yii 2 framework. Researchers and national defenders reported that the vulnerabilities are being **actively exploited in the wild**, with investigations tying attacks to malicious requests targeting the `actions/assets/generate-transform` endpoint and abuse of `__class` parameters. Organizations running exposed Craft CMS instances were urged to patch immediately, review logs for suspicious POST activity, check file and system integrity, and rotate credentials if compromise is suspected.
Jul 24, 2026
A series of critical vulnerabilities have been disclosed affecting a wide range of popular software platforms, including WordPress plugins, web frameworks, developer tools, and enterprise applications. Notable issues include unauthenticated remote code execution (RCE) flaws in Next.js (CVE-2025-66478), WordPress core (CVE-2025-6389), and the ACF Extended plugin (CVE-2025-13486), as well as privilege escalation and authentication bypass vulnerabilities in the WP Directory Kit plugin (CVE-2025-13390) and cPanel. Several of these vulnerabilities are reported to be under active exploitation, with proof-of-concept code available for some, increasing the urgency for immediate patching and mitigation. Other significant disclosures include a high-severity flaw in Vim for Windows (CVE-2025-66476) allowing arbitrary code execution, a critical SQL injection chain in Synology BeeStation, and a directory traversal vulnerability in cPanel that could lead to full server takeover. Additional advisories cover issues in lz4-java, Longwatch OT surveillance, Django, Elementor, Apache Struts, nopCommerce, and OpenVPN, with many rated as critical or high severity by CVSS. Organizations are strongly advised to review affected products and apply security updates promptly to mitigate the risk of exploitation.
Jun 29, 2026