1.4 Million Sites Were on the List. 25,195 Had Evidence of Compromise.
WP-SHELLSTORM put more than 1.4 million domains into attack lists. That is not the number of sites the operators compromised.
An exposed attacker server revealed a webshell-access brokerage operation built around 27 already-known vulnerabilities. The files included roughly 800MB of exploit scripts, scan results, webshells, command history and command-and-control settings. Researchers could see both the intended scale and parts of the actual outcome.
The measurements differ because they answer different questions. SOCRadar counted more than 5,700 active webshells during its analysis. Ctrl-Alt-Intel reconstructed 25,195 unique sites with confirmed or validated compromise evidence from the surviving dataset. The 1.4 million figure describes domains in overlapping target lists across WordPress, Joomla and other applications.
A domain can be queued, scanned, attacked and rejected without ever being compromised. Preserving that distinction is essential for accurate incident reporting and useful defence.
The attacker left the workshop open
The visibility came from an operational mistake. A Python SimpleHTTPServer used for file transfer was reportedly left reachable without authentication for 22 days. Two research teams examined the exposed directory independently.
The operator used reconnaissance results from FOFA and automated exploitation against large lists of websites. Successful attacks planted PHP webshells that provided persistent remote access. That access could be maintained, packaged or sold to another criminal.
The toolkit did not depend on a single zero-day. It industrialised a set of public vulnerabilities whose patches and configuration conditions varied widely. The exposed server made the conversion rate visible: huge target lists produced very different results depending on the product, version and deployment setting.
Breeze produced the largest confirmed WordPress cohort
The most productive exploit in the retained WordPress data targeted CVE-2026-3844 in the Breeze Cache plugin. The flaw allowed unauthenticated arbitrary file upload and could lead to remote code execution in versions through 2.4.4.
The vulnerability had an important configuration condition. It was exploitable when the non-default Host Files Locally – Gravatars setting was enabled. Sites without that setting were not exposed to this specific path.
Ctrl-Alt-Intel’s reconstructed data identified 17,064 confirmed sites in the Breeze cohort. The result does not mean every vulnerable Breeze installation was compromised, but it demonstrates that a configuration-dependent plugin flaw can still produce a large, repeatable intrusion path when attackers can discover and test targets automatically.
Breeze 2.4.5 fixed the issue. Updating is necessary. It is not sufficient for a site that may already contain a webshell.
Target volume and exploit success diverged sharply
The toolkit also included a maximum-severity flaw in the Joomla JCE editor, CVE-2026-48907. The operator aimed it at more than 560,000 targets, yet researchers found only 77 successful shells in the associated results. The flaw was fixed in JCE 2.9.99.5 and was later added to CISA’s Known Exploited Vulnerabilities catalogue.
That contrast explains why target-list size is a poor proxy for victim count. Attackers can obtain or generate enormous lists cheaply. Successful compromise depends on whether the relevant component is installed, vulnerable, reachable and configured in the way the exploit expects.
It also explains why defenders should not dismiss low conversion. Seventy-seven working shells are still seventy-seven persistent access points. A small success rate can be commercially useful when scanning and exploitation are almost free.
Patch, then hunt for persistence
Operators of WordPress and Joomla estates should treat the research as an incident-hunting prompt, not merely a version-management reminder.
- Inventory every public site, plugin, extension, version and security-relevant setting.
- Update Breeze to 2.4.5 or later and JCE to 2.9.99.5 or later.
- Search uploads, cache and extension directories for unexpected PHP files and recent modifications.
- Compare administrator accounts, scheduled tasks, application passwords and configuration changes with an approved baseline.
- Review web logs for exploit requests and follow-on access, preserving evidence before cleanup.
- Rotate credentials and secrets reachable from a compromised site, including database and cloud keys.
- Rebuild from a trusted source when file integrity cannot be established.
The most useful number in WP-SHELLSTORM is not the largest one. The operation shows how public vulnerabilities, search engines and simple automation turn a heterogeneous website ecosystem into a production queue. The defensive task is to know which entries became incidents.
Sources: Ctrl-Alt-Intel: Chinese actor compromises thousands of WordPress sites (published 22 June 2026; no publication time provided), SOCRadar: WP-SHELLSTORM (published 9 July 2026; no publication time provided), The Hacker News independent report (published 10 July 2026; no publication time provided), and the NVD vulnerability record (published 22 April 2026; publication time not provided on the public page).
