The Australian Cyber Security Centre (ACSC) has issued a high-priority alert about a large-scale global campaign exploiting at least 17 known vulnerabilities in popular Content Management Systems (CMS) like WordPress and Joomla, and their plugins. Attackers are actively scanning for and exploiting these unpatched flaws to deploy webshells, enabling persistent access for data theft, malware distribution, and further network compromise. The ACSC urges all organizations to patch their systems immediately and inspect for signs of compromise.