Stolen TeamUpdraft keys used to backdoor connected WordPress sites
Patchstack saw attacks from October 18 using UpdraftCentral keys to install at least 99 malicious plugin variants and create admin accounts.
74
Vendor
TeamUpdraft
- Mentions · 7d7
- Mentions · 30d7
- All mentions7
- First seenOct 19, 2026
- Last mentioned4d ago
Timeline
7 articles · newest firstStolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft says its site was breached on October 17-18, and attackers installed backdoor plugins for about 18 hours.
78
Stolen UpdraftCentral keys used to install malicious WordPress plugins
TeamUpdraft suspects an October 17-18 website breach exposed connection keys; 1.26.13 and 2.26.13 disconnect older links.
74
TeamUpdraft breach exposed keys used to backdoor WordPress sites
Exposed data reportedly included password hashes, billing details, and keys for UpdraftCentral, UpdraftVault, and UpdraftClone.
74
Stolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft says a weekend breach exposed remote-management keys; Patchstack logged backdoor plugins on connected sites.
76
Stolen UpdraftCentral keys used to install malicious WordPress plugins
TeamUpdraft says its site was accessed October 17–18 and the database held UpdraftCentral, Vault, and Clone keys.
78
Stolen UpdraftCentral keys used to backdoor WordPress sites
Signed commands installed backdoor plugins from October 18 to 19; no plugin update stops it, so sites must delete UpdraftCentral keys.
78
Appears with
- UpdraftPlusproduct · 7
- UpdraftCentralproduct · 7
- Nethembaorganization · 5
- UpdraftVaultproduct · 4
- Patchstackorganization · 4
- UpdraftCloneproduct · 4
- Wordfenceorganization · 2
- Nethembavictim · 2
- WordPressproduct · 2
- Information Commissioner's Officeorganization · 2
- TeamUpdraftvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.