ACSC Warns of Global Mass Exploitation Targeting WordPress, Joomla, Craft CMS

Australia's Cyber Security Centre issued a critical alert on July 11, 2026, warning of a large-scale global cyberattack campaign targeting popular content management systems including WordPress, Joomla, and Craft CMS. Threat actors are systematically scanning for internet-facing websites running unpatched versions of these platforms and their plugins, exploiting 17 known vulnerabilities to gain initial access. The attackers' primary goal is to install webshells on compromised servers, enabling persistent remote access for data theft, website defacement, phishing hosting, and lateral movement into internal networks. Small and medium-sized businesses in Australia and globally have been disproportionately affected, with many falling victim due to long-standing failures in patch management. The ACSC urges organizations to apply available patches immediately and conduct thorough system audits, noting that AI-assisted tools may be helping attackers weaponize vulnerabilities faster than defenders can respond.