highclosedpartial fix
TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored
› UpdraftPlus / UpdraftCentral (WordPress)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Oct 18, 2026
- closed
- Oct 20, 2026
- CVEs
- none
- sources
- 1
## summary
UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral.
severity: High supply-chain / credential theft
## affected
- Sites with stolen UpdraftCentral connection keys
## fixed in
no fixed release yet
## news & write-ups[1]
## notes & caveats
Rotate UpdraftCentral keys and audit connected sites; patchStatus partial until each site is verified clean.
