Originally published on CyberNetSec.
On July 11, 2026, the ** Australian Cyber Security Centre (ACSC)** released a critical alert detailing a large-scale, global cyberattack campaign. Threat actors are systematically exploiting a wide range of known, patched vulnerabilities in popular Content Management Systems (CMS) and their associated plugins. The primary targets include
The campaign is characterized by its broad scope and reliance on exploiting old, unpatched vulnerabilities. Attackers are conducting mass scanning operations to identify internet-facing websites running vulnerable versions of CMS platforms or plugins. Once a target is identified, the attackers exploit a known flaw to achieve initial access, with the end goal of up a webshell.
A webshell provides a backdoor, allowing the attacker to execute commands on the server, manipulate files, and access databases. This access is then used for various malicious purposes:
The ACSC noted that the use of AI by threat actors may be accelerating their ability to weaponize newly disclosed vulnerabilities, shortening the window for defenders to patch.
The campaign leverages a list of 17 specific vulnerabilities. The exploitation of these flaws falls under the MITRE ATT&CK technique T1190 - Exploit Public-Facing Application. The ultimate goal is the installation of a webshell, which corresponds to
T1505.003 - Server Software Component: Web Shell
The targeted vulnerabilities include, but are not limited to:
`CVE-2026-1357`
), Ninja Forms (`CVE-2026-3844`
), Breeze Cache (`CVE-2026-1969`
), Gravity Forms (`CVE-2025-12352`
), and others.`CVE-2026-0740`
).`CVE-2025-34085`
), MaxSite CMS (`CVE-2020-36847`
), and MetInfo CMS (`CVE-2025-7852`
).These vulnerabilities range from unauthenticated file uploads to remote code execution and server-side request forgery (SSRF). The fact that many of these have had patches available for months or years indicates a systemic failure in patch management across many organizations.
The impact on a compromised organization can be severe. A public-facing website is often the gateway to an organization's digital presence. A breach can lead to significant reputational damage from website defacement or data leaks. The theft of customer data can result in regulatory fines and loss of trust. If the compromised web server is used as a pivot point into the internal network, it can lead to a full-scale enterprise breach, potentially culminating in a ransomware attack. For small and medium businesses with limited security resources, recovering from such an attack can be financially devastating.
No specific webshell hashes, IP addresses, or C2 domains were mentioned in the source articles.
Security teams should proactively hunt for signs of compromise related to this campaign:
| Type | Value | Description |
|---|---|---|
| url_pattern | */wp-content/plugins/*/ |
|
Look for suspicious POST requests to plugin directories, especially for file uploads (.php , .phtml ). |
||
| file_name | *.php |
|
| Search for recently created or modified PHP files in unexpected locations, such as image upload directories. | ||
| log_source | Web Server Access Logs |
|
| Scrutinize logs for requests to known vulnerable endpoints associated with the listed CVEs. Look for unusual user agents or requests from a single IP hitting multiple non-existent pages. |
| command_line_pattern | (curl | wget) http:///.sh |
.php
..jpg
file that is later executed). This is an application of D3-NTA - Network Traffic Analysis
The most critical mitigation is timely patch management.
M1051 - Update Software
M1022 - Restrict File and Directory Permissions
M1030 - Network Segmentation