## Executive summary: The Australian Cyber Security Centre (ACSC) warns of a large-scale global campaign actively exploiting multiple CMS software and plugin vulnerabilities to deploy webshells against internet-facing websites (notably WordPress, Joomla and several CMS platforms), impacting many small-to-medium Australian businesses; the alert lists affected plugins/CVEs, describes likely attacker uses (defacement, credential theft, malware distribution, lateral movement) and provides detailed detection and remediation guidance.