October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
86
Product
UpdraftPlus
- Mentions · 7d8
- Mentions · 30d8
- All mentions8
- First seenOct 19, 2026
- Last mentioned3d ago
Timeline
8 articles · newest firstStolen TeamUpdraft keys used to backdoor connected WordPress sites
Patchstack saw attacks from October 18 using UpdraftCentral keys to install at least 99 malicious plugin variants and create admin accounts.
74
Stolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft says its site was breached on October 17-18, and attackers installed backdoor plugins for about 18 hours.
78
Stolen UpdraftCentral keys used to install malicious WordPress plugins
TeamUpdraft suspects an October 17-18 website breach exposed connection keys; 1.26.13 and 2.26.13 disconnect older links.
74
TeamUpdraft breach exposed keys used to backdoor WordPress sites
Exposed data reportedly included password hashes, billing details, and keys for UpdraftCentral, UpdraftVault, and UpdraftClone.
74
Stolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft says a weekend breach exposed remote-management keys; Patchstack logged backdoor plugins on connected sites.
76
Stolen UpdraftCentral keys used to install malicious WordPress plugins
TeamUpdraft says its site was accessed October 17–18 and the database held UpdraftCentral, Vault, and Clone keys.
78
Stolen UpdraftCentral keys used to backdoor WordPress sites
Signed commands installed backdoor plugins from October 18 to 19; no plugin update stops it, so sites must delete UpdraftCentral keys.
78
Related CVEs
by mentions- CVE-2026-025797%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-11149733%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
- Auth bypass in Apache Tomcat JNDIRealm with non-GSSAPI SASL
Appears with
- TeamUpdraftvendor · 7
- UpdraftCentralproduct · 7
- Nethembaorganization · 5
- Patchstackorganization · 4
- UpdraftCloneproduct · 4
- UpdraftVaultproduct · 4
- Wordfenceorganization · 2
- Nethembavictim · 2
- Information Commissioner's Officeorganization · 2
- WordPressproduct · 2
- LiteLLMproduct · 1
- Unit 42organization · 1
- Apache Tomcatproduct · 1
- Wizorganization · 1
- Cloudflareorganization · 1
- OVHcloudvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.