Article
F5 breach: when your security vendor is hacked
The F5 breach shows how a vendor hack becomes customer risk. See what was taken, what CISA and the NCSC advised, and which checks…
Read more
Significant cyber incident
UpdraftCentral Key Compromise (October 2026)
Also known as UpdraftCentral key theft
The developer of the WordPress backup plugin UpdraftPlus and the UpdraftCentral dashboard says someone gained unauthorised access to its website over the weekend of 17 to 18 October 2026.
In short
The developer of the WordPress backup plugin UpdraftPlus and the UpdraftCentral dashboard says someone gained unauthorised access to its website over the weekend of 17 to 18 October 2026. It believes its customer database, which holds UpdraftCentral connection keys, was accessed. Patchstack and Nethemba report that an attacker used valid keys to install backdoor plugins on connected WordPress sites from 18 October. The developer says version 1.26.13 (free) and 2.26.13 (Premium) revokes keys made before 13:07 BST on 18 October.
What happened
The developer says that over the weekend of 17 to 18 October 2026 it identified unauthorised access to its website. It believes its customer database was accessed. It says the data may include names, emails, billing addresses, order history, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It says it stores no card details.
The WordPress security company Patchstack and the security firm Nethemba report that an attacker then used valid UpdraftCentral keys to send signed plugin upload commands to connected sites. Nethemba found the campaign on 19 October after backdoor plugins crashed its own sites. Both published analyses the same day. The campaign story for site owners is in our post UpdraftCentral keys stolen: how the WordPress backdoor campaign works.
We ran three outside checks on 23 October. GitHub: three repositories for the separate June flaw CVE-2026-10795. X: about 133 unique posts since 17 October, mostly news repeats and round-ups of the week’s incidents. Dark web (THANOS): 39 results across three search terms, mainly Telegram news channels, two posts on a Russian-language forum and one on Discord.
Timeline
- 17 to 18 Oct 2026 (weekend)
The developer says it identified unauthorised access to its website and believes its customer database was accessed.
- 18 Oct 2026, 15:32 (no time zone given)
Patchstack's telemetry shows the first backdoor plugin installation it observed through UpdraftCentral.
- 18 Oct 2026, 23:10 CEST
Nethemba says a probe hit another administrator's site, followed by backdoor uploads.
- 19 Oct 2026, 04:14 CEST
A backdoor is installed on one of Nethemba's sites and the site starts answering every request with error 500. At 05:38 Nethemba receives an automatic WordPress email about an unknown plugin.
- 19 Oct 2026, 09:23 (no time zone given)
Patchstack's telemetry shows the most recent backdoor installation it observed. Patchstack describes an 18-hour campaign window on 18 and 19 October.
- 19 Oct 2026, 13:00 UTC
The developer publishes its security incident post, according to Patchstack's timeline. Nethemba and Patchstack publish their analyses on 19 October, and Patchstack starts blocking UpdraftCentral remote commands.
- 19 Oct 2026, just after 10pm BST
The developer publishes UpdraftPlus 1.26.13 and 2.26.13, which revoke UpdraftCentral connection keys made before 13:07 BST on 18 October. Nethemba says the earlier 1.26.12 and 2.26.12 deleted no keys because of a bug.
- 20 Oct 2026
The developer says WordPress.org pushed the fixed release to all users. Nethemba reports attempts to trigger removed backdoors on at least six sites, from several IP addresses.
- 21 Oct 2026
At 10:23 BST the developer says the attacker used a compromised key and that it has no evidence the attacker still has access. At 15:35 BST it urges Premium users to check their sites. Nethemba reports commands to two of its sites from 07:10 to 09:21 UTC, after the fixed release, which its own blocking rule stopped.
- 22 Oct 2026, 14:42 BST
The developer says its support form is back online. It asks users to check sites in UpdraftCentral that they did not knowingly connect since 19 October, looking for unexpected editor roles, unknown plugins and unfamiliar IP addresses.
- 23 Oct 2026, 05:26 BST
The developer's notice shows its latest update time.
How the attack worked
Patchstack describes a key compromise, not a code flaw. The UpdraftCentral client ships in every copy of UpdraftPlus and stays dormant until a site holds a key. The attacker sends a signed plugin.upload_plugin command, and WordPress installs and activates the plugin. Patchstack says keys do not expire, and that a checkbox to add a site to UpdraftCentral is hardcoded as checked when the site is connected to an account on the developer’s website.
The plugin watches requests for a secret parameter with a 32-character token. Patchstack says that when it sees the token it creates an Editor account, grants it extra capabilities and sets a login cookie, which skips the login form and two-factor authentication. The account stays after the plugin is removed. Early samples crashed sites because of a coding error. Both researchers warn not to repair them. The pattern fits a supply chain attack, since the keys were held by a supplier.
Who says who was behind it
No attacker is named. The developer says it has contacted the police and hired an external security firm, and it has not named a suspect.
On 21 October the developer said the speed of the exploits and the faulty first backdoor plugins suggest the attackers used AI to speed up their work. That is the vendor's inference, and neither researcher confirms it.
Nethemba says the same IP address, 43.250.53.42, probed two sites of another administrator on 23 September 2026 with a REST API query and path traversal attempts. It reads this as the attacker exploring those sites almost a month before the UpdraftCentral attack. Nethemba places the address at the hosting provider RedSwitches and does not say who runs it. No government or security company we read has attributed the campaign.
Impact
The developer has not published how many customers, keys or sites were affected. Nethemba estimates that up to around 400,000 sites could hold a key. It bases this on more than 4 million active installs and on the vendor's estimate that fewer than 10% of UpdraftPlus users hold an UpdraftCentral or Migrator key. The vendor gave that estimate for the June flaw. Nethemba says the number actually compromised is unknown. The developer says every UpdraftVault site was disconnected and every UpdraftClone client key was replaced. Patchstack observed 99 distinct backdoor plugin names.
Government and regulator response
- The developer says it locked down access to its site, hired an external security firm and contacted the police (notice, 21 October).
- It published UpdraftPlus 1.26.13 and 2.26.13 on 19 October. WordPress.org pushed it to all users (notice, 20 October).
- It disconnected all UpdraftVault sites and replaced all UpdraftClone client keys (notice).
- It published steps for every account holder and for each UpdraftCentral site, and asked Premium users to check for unusual activity even if they never used UpdraftCentral (notice, 21 October).
- Patchstack deployed mitigation rules that block UpdraftCentral remote commands on 19 October.
Lessons
-
A supplier can hold the keys to your sites
The dashboard private keys were stored at the plugin's developer, not on the victim sites, so patched and well run sites were still reachable. Track such suppliers as third-party risk.
-
A default setting created keys nobody chose
Patchstack says the box that adds a site to UpdraftCentral is hardcoded as checked, so some owners hold keys they never meant to create. Check the key list on every site.
-
Update and revoke are two different steps
Nethemba says 1.26.12 deleted no keys because of a bug, and that keys made between 12:07 and 21:00 UTC on 18 October survive 1.26.13. Confirm that no key remains.
-
Removing the plugin does not remove the account
Patchstack says the rogue account stays after the plugin is deleted. Check users as well as plugins.
-
Do not fix the broken backdoor
Both researchers say the first plugins crashed because of a coding error, and that repairing the error would switch the backdoor on.
What to check in your own organization
-
Look for a stored key
Run wp option get updraft_central_localkeys on every WordPress site with UpdraftPlus, including sites that never used UpdraftCentral (Patchstack). In the dashboard, open Settings, UpdraftPlus, Advanced Tools, UpdraftCentral and delete the key (developer's notice).
-
Check plugins, including Must-Use
Look for plugins you do not recognise. Patchstack lists the description "Small maintenance toolkit: keeps option storage tidy." and the name "Site Health Cache" as the strongest markers. Nethemba also names leftover files in wp-content/upgrade/.
-
Check users and roles
Look for unknown administrators and for Editor accounts you did not create. Patchstack lists an @example.org email, the display name "Site Tools" and a database option ending in _sync_token. Nethemba also lists @example.com addresses.
-
Search the access logs
Patchstack says to look for requests that carry the trigger parameter with a 32-character token, and for a User-Agent that lacks the version and URL genuine UpdraftCentral traffic carries. Nethemba names the User-Agent "WordPress/6.4; class-udrpc.php".
-
Read the UpdraftCentral log
Nethemba says to look for Command received entries for plugin.upload_plugin or plugin.delete_plugin. The log keeps only 50 events, so the access logs matter as well.
-
Treat a hit as a full compromise
If the account exists or the trigger shows up in the logs, Patchstack says to restore a backup from before the attack and compare files with a clean install. Then rotate passwords, end sessions and turn on two-factor authentication. The developer suggests a backup from before 17 October.
Questions
What did the UpdraftPlus developer say was accessed?
The developer says it believes its customer database was accessed. The data may include names, emails, billing addresses, order history, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It says it stores no card details.
Was this a vulnerability in UpdraftPlus?
Patchstack describes it as a key compromise, not a code flaw. The June flaw CVE-2026-10795 is a separate issue that was fixed in 1.26.5 and 2.26.5, according to Patchstack, and Nethemba says its attacked sites already ran a patched version.
Which version should I run?
The developer says 1.26.13 (free) or 2.26.13 (Premium) or later. Nethemba says not to rely on 1.26.12 or 2.26.12, because that release deleted no keys.
Do I still need to delete keys after updating?
Yes, check. Nethemba says keys created between 12:07 and 21:00 UTC on 18 October are not removed by the update. The developer says the update disconnects connections made before 13:07 BST on 18 October, which is 12:07 UTC.
Who is behind the campaign?
Nobody has been named. The developer says it has contacted the police, and no government or security company we read has attributed it.
In our research
- F5 breach: when your security vendor is hacked October 2026
- WP2Shell Technical Analysis: CVE-2026-63030 & CVE-2026-60137 WordPress Core RCE Chain July 2026
- Supply chain attack Glossary term
Sources
- Security Incident, October 2026 UpdraftPlus developer
- UpdraftCentral Key Compromise and WordPress Backdoors Patchstack
- UpdraftCentral Backdoor Analysis Nethemba
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 69 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.