Stolen TeamUpdraft keys used to backdoor connected WordPress sites
Patchstack saw attacks from October 18 using UpdraftCentral keys to install at least 99 malicious plugin variants and create admin accounts.
74
Victim
Nethemba
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 21, 2026
- Last mentioned4d ago
Timeline
2 articles · newest firstStolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft says a weekend breach exposed remote-management keys; Patchstack logged backdoor plugins on connected sites.
76
Appears with
- UpdraftPlusproduct · 2
- UpdraftCentralproduct · 2
- TeamUpdraftvendor · 2
- Patchstackorganization · 2
- WordPressproduct · 1
- UpdraftVaultproduct · 1
- Information Commissioner's Officeorganization · 1
- UpdraftCloneproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.