type: incident · created: 2026-07-11 · updated: 2026-07-11 · tags: [incident, campaign, au-focus] · confidence: high · affected_sectors: [technology, government, finance, healthcare, education, media] · au_impact: true
ACSC CMS Exploitation Campaign
The Asd's Australian Cyber Security Centre (ACSC) issued a critical-rated alert in July 2026 tracking a large-scale exploitation campaign targeting multiple vulnerabilities in web Content Management Systems (CMS). The campaign poses a significant threat to Australian organisations.
Alert Details
| Field | Value |
|---|---|
| Issuing authority | ASD's ACSC (via cyber.gov.au) |
| Date | July 9, 2026 |
| Rating | CRITICAL |
| Target | Vulnerabilities in web Content Management Systems |
| Affected AU entities | SMBs, critical infrastructure, government agencies |
Affected Populations
- Small & medium businesses (SMBs) — particularly vulnerable
- Critical infrastructure operators — under Soci Act
- Government agencies at all levels
- Any organisation running outdated CMS platforms (raw/digests/Cyber-Digest-2026-07-10)
Related Threats
The Wp Shellstorm operation demonstrates the real-world impact of CMS-based webshell backdooring — 1.4 million websites catalogued, backdoors installed via outdated plugins like Breeze and JCE Editor.
ACSC Guidance
- Specific vulnerabilities and mitigations detailed in the advisory
- Organisations urged to patch CMS platforms immediately
- SMBs are particularly at risk (raw/digests/Cyber-Digest-2026-07-11)
Australian Significance
- PRIMARY AU FOCUS — This is the highest-priority alert for Australian organisations
- All sectors running web CMS platforms should assess exposure
- Complements global CISA KEV updates targeting similar vectors
Related Pages
- Wp Shellstorm — Webshell backdoor brokerage operation
- Fortibleed — Another active campaign affecting AU infrastructure
- Ghostlock Cve 2026 43499 — Linux kernel vulnerability affecting AU cloud infrastructure