Australia’s Cyber Warning Every Website Owner Needs to See

Australia’s cyber security agency has issued a new warning today. State-linked attackers are actively searching for vulnerable websites and web applications. WordPress was specifically mentioned, and they’re not just looking for passwords. They have used weaknesses inside websites to steal credentials and sensitive information.

At the same time, another national cyber agency has warned about attacks against the APIs connecting business systems together. That matters because the website itself may not be your biggest risk anymore. It may be what the website is connected to.

Hi, I’m Dustin Gray. I’ve been building production software for 25 years, and I look at the security stories that matter today.

The Australian Cyber Security Centre has joined international partners in a new advisory published today. It covers activity linked to Chinese state-backed actors, but I want to focus on one part that matters to businesses running websites and online systems. The attackers are scanning public websites looking for known weaknesses, and WordPress is specifically among the technologies mentioned.

They have also used website vulnerabilities to place malicious content inside legitimate pages. In one documented example, the altered page presented users with fake login fields, and anything entered there could be stolen. The advisory also describes attackers downloading databases after gaining access.

This is confirmed real-world threat activity, but the advisory doesn’t say these particular attacks were confirmed against Australian organisations. ASD is warning Australian organisations because the methods are relevant here. And there’s a bigger lesson: your public website is part of your organisation's attack surface, not just a marketing asset.

Ask: who manages our website today? Are all public systems fully patched? Are unused services still exposed? Are administrator accounts protected with strong authentication?

And importantly, are website access logs actually being reviewed for signs of attack? ASD’s advice is not simply to install your updates. It also recommends looking for evidence that somebody may have been inside.

This next one is particularly important for organisations with membership portals, mobile apps, CRM integrations or connected business systems. Japan’s national cyber response team, JPCERT/CC, has issued an unusual warning. Organisations there have suffered large-scale personal data leaks, and some of the attacks didn’t start by breaking into the website itself.

They targeted the connections between applications, which are commonly called APIs. Think of an API as the doorway one business system uses to talk to another. JPCERT says attackers have identified those doorways from public applications.

They have stolen API keys. They have found internal functions that were never meant to be publicly accessible, and they have used them to create accounts, change user permissions and search for information.

Today JPCERT added more indicators of attack, and it added another confirmed attack pattern. Attackers had placed a hidden control mechanism on an application server reachable through a public web server. There is no confirmation of this campaign affecting Australian organisations, but the security principle applies directly to any connected web application.

If your website or member portal connects to other systems, ask which APIs are publicly reachable and what each connection can access. How long do those access keys remain valid? And would we know if somebody started using them abnormally? Securing the front door doesn’t help much if a side door between your systems has been left open.

Now to WordPress, because this one has moved beyond a theoretical vulnerability: attackers are actively targeting websites using Bricksforge. Bricksforge extends the Bricks website builder, and the weakness affects its form functionality. An attacker does not need a WordPress account.

They can manipulate the way files are handled by the website, which can allow them to place executable code on the server. In plain English, that can become a complete website takeover. Security researchers are already seeing automated exploitation attempts from dozens of different sources.

The vendor has released a fix. Importantly, the vendor says the affected form feature can create risk even where the website doesn’t visibly use a file upload field. So simply saying “we don’t let customers upload files” is not enough.

If you use Bricksforge, have your website provider confirm today that you’re running a fixed release. But because attacks are already happening, don’t stop there. Have them check for unexpected files, unknown administrator access and unusual activity on the hosting account. Once executable code has reached the server, an update alone does not prove the website is clean.

Next up, another WordPress problem that I think management will understand immediately. BackWPup is a backup plugin used on more than 400,000 websites. A newly published vulnerability shows how the thing designed to protect your website can also become one of its most valuable targets.

Under specific conditions, an interrupted website restore can leave a complete backup archive in a location someone on the internet may be able to reach. That archive can contain the website files, the database, password-related information and secret keys used by the application. So this isn’t simply somebody seeing an old copy of your homepage. A complete backup can contain almost everything needed to understand or compromise the website.

The issue affects versions before 5.7, and I haven’t found any evidence of active exploitation. If your organisation uses BackWPup, confirm it is at least version 5.7. Then ask one more question: where are our backups stored, and can any of them be reached from the public website?

If an affected website had an interrupted restore, have that exposure checked. And if a backup was publicly accessible, assume the secrets inside it may also need changing. A backup should help you recover from a breach; it should never become the breach.

And finally, something a little unusual from Next.js. Next.js is technology used behind many modern websites, portals and custom applications. Normally we hear about a security problem when the patch is released, but this time the vendor is warning organisations in advance.

Next.js says an emergency security update will be released next Wednesday, 14 October. It will address three problems in software Next.js depends on: two are rated critical and one is rated high. And here’s the important part: we do not yet have the full impact.

Make sure somebody is responsible for reviewing the 14 October advisory, and make sure there is a plan to test and deploy the update once the affected versions are known. This is the kind of warning period good security teams should use, not ignore. Emergency patching is much easier when you already know which systems you’re responsible for.

There’s a much clearer lesson across today’s stories. The website is no longer an isolated thing. It has hosting, plugins, backups, APIs, databases, authentication, third-party services and connections to other business systems. Every connection creates another trust boundary.

That’s why looking at a website and asking “is it working?” tells you almost nothing about its security. The better question is: if this system is compromised, what else does it have access to? That’s the difference between something that works and something that is secure and production ready.