43[.]250[.]53[.]42

Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote management service that's used for managing multiple sites remotely. A client component of UpdraftCentral is shipped within every copy of UpdraftPlus. "Over the weekend of 17-18 October we identified unauthorized access to the teamupdraft.com website," TeamUpdraft said in a statement. "Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected." As a result of the incident, threat actors are believed to have accessed its customer database, which holds the following information - Names, email addresses, billing addresses and order history Account passwords, stored only in hashed (scrambled) form and never in plain text Two-factor authentication (2FA) settings Connection keys for UpdraftCentral, UpdraftVault and UpdraftClone TeamUpdraft said the database does not hold any financial information, and that they are handled by Stripe and PayPal. It also emphasized that the UpdraftPlus plugin, along with self-hosted versions of UpdraftCentral and backups sent to customers' own remote storage, are not impacted. "However, if your site was accessed through UpdraftCentral, please also re-authorise your remote storage and change any storage access keys, as a precaution," it said. In addition, TeamUpdraft said it deployed a fix to address the underlying issue, signed out every teamupdraft.com account and reset login security across the site, and released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to automatically disconnect every UpdraftCentral connection made before 10 p.m. BST on October 18, 2026, to prevent the old keys from working. Other steps taken by the developer are listed below - Disconnected every site from UpdraftVault and issued new credentials Replaced every UpdraftClone client key Rotated its keys with payment providers and other connected services Implemented additional monitoring in place Reported the incident to the U.K. Information Commissioner's Office (ICO) and other relevant authorities Users who have a teamupdraft.com account are advised to change their password with immediate effect (and elsewhere, if the same password has been reused), reset 2FA settings, and exercise caution when receiving unexpected emails claiming to be from TeamUpdraft. TeamUpdraft is also recommending that cloud customers of UpdraftCentral follow the steps below as soon as possible, since the connection keys can send commands to the connected sites - Log in to the site's own WordPress dashboard, not through UpdraftCentral. Update UpdraftPlus to version 1.26.12 (free) or 2.26.12 (Premium) or later. Disconnect it from UpdraftCentral: go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the connection key. Go to Users and check for any administrator accounts you don’t recognise. Remove them. Go to Plugins, including the Must-Use tab if you can see it, and check for anything you don’t recognise. Remove it. Change the passwords for all administrator accounts on the site. If you find anything suspicious, consider restoring the site from a backup taken before 17 October. Reconnect the site to UpdraftCentral. UpdraftVault users are being urged to reconnect their sites to the backup service, and UpdraftClone users who have created a client key are required to copy the new keys from My Account > UpdraftClone > UpdraftClone Key Management and share them with their clients. The development comes as WordPress security company Patchstack said it observed an attacker holding valid UpdraftCentral dashboard keys issuing commands to install backdoor plugins on connected WordPress sites. The campaign is said to have run continuously through an 18-hour window on October 18 and 19, 2026. "The attacker sends a signed plugin.upload_plugin command over the plugin's remote procedure call channel, which listens on ordinary POST requests to the site root. WordPress installs and activates the supplied plugin through its standard installer," Patchstack security researcher Dave Jong said. Slovakia-based penetration testing company Nethemba, which first detected the attack in the wild, has described the rogue plugin as a backdoor that hooks into every request to the site to check if the URL contains the parameter "?_9f5696=" and compares it with a 32-character token. If a matching token is detected, it creates a user "data-ops43" with the display name "Site Tools," assigns it the Editor role, and grants the account "manage_options" and "install_plugins" permissions, allowing the operator to upload arbitrary PHP plugins and open site settings. "Enabling registration and setting the default role to administrator is enough for the attacker to create a full administrator," Nethemba said. "On a standard WordPress site, an Editor also has unfiltered_html, so the account can put JavaScript into posts that runs in the browser of every administrator." "The backdoor has a second layer as well. The account it creates, with a known password, stays in WordPress even after the plugin is removed, and the attacker can log in with it through the normal login form unless two-factor authentication is enabled for that account." Although an early version of the plugin suffered from a coding error that causes impacted sites to fail with error 500, Nethemba said the threat actor deleted the broken backdoor by sending a "plugin.delete_plugin" command and then uploaded a working version that creates a full administrator account or logs in as an existing administrator. WordPress site owners are advised to check for the following indicators of compromise - Plugin names: Site Health Cache or Site Health 364F, Asset Forge 2, Content Helper, Wp Forge, Query Shelf, Style Bridge 8F5, Media Kit 183, Query Shelf, Post Dock 776, Nav Hub, Speed Desk, Speed Kit 300, Link Latch, Script Shelf, or Feed Case Account names: system_team850, web.tech988, cmseditor170, cms.tech644 or web_mgr684, with an email at @example.com and a display name such as System Team, Web Tech, System Staff, System Ops, or Cms Tech IP addresses: 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9 In all, Patchstack said it observed 99 distinct backdoor plugin names, with each sample carrying the line "Small maintenance toolkit: keeps option storage tidy." Wordfence, which published its own analysis of the incident, said a WordPress site may be affected if the below criteria are satisfied - The site had UpdraftPlus Free or UpdraftPlus Premium installed and active while the affected UpdraftCentral connection key was present. The site has, or had during the incident, an active connection key for TeamUpdraft’s cloud-hosted UpdraftCentral service. "This is the second incident in this channel in five months," Patchstack warned. "In June 2026 the vendor fixed CVE-2026-10795 (CVSS 8.1), where an obsolete unsigned message format let an attacker forge UpdraftCentral commands with no keys at all. That was fixed in 1.26.5 and 2.26.5, but exploitation attempts continue, so sites below those versions face both problems at once." The development comes days after the website of the Rank Math PRO WordPress plugin was hit by a software supply chain attack, causing users who downloaded version 3.0.123 between October 15 at 8:02 p.m. UTC and October 16 at 7:12 a.m. UTC to receive compromised versions that planted hidden backdoors. The incident has been assigned the CVE identifier CVE-2026-111862 (CVSS score: 9.8). The issue was fixed in Rank Math PRO version 3.0.124. "The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server," Wordefence said. The findings also coincide with an advisory from PHP, which said it intends to ship a security release that fixes two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS scores: 9.2), as information about the flaws leaked ahead of their scheduled disclosure. The flaws have been codenamed PHP2Shell. According to watchTowr CEO Benjamin Harris, the vulnerabilities affect PHP versions 5, 6, 7, and 8, and were originally due for release on October 22 at 11 a.m. ET. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," Huntress said. "When a critical bug lands in PHP itself, rather than in one app built on top of it, the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast."

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical. The three security issues were added separately last week and have severity ratings ranging from medium to critical. One of them, tracked as CVE-2025-39964, existed in the Linux kernel for 14 years. CISA marked all three flaws with the highest priority for federal agencies, ordering them to apply available security updates and mitigations by the end of today. The three vulnerabilities are: CVE-2025-39964: a race condition in the kernel’s AF_ALG cryptographic socket interface that allows concurrent writes to corrupt per-socket state and potentially crash systems or alter cryptographic results. CVE-2026-53266: an out-of-bounds write vulnerability in the Linux kernel’s ebtables SNAT implementation that can cause an ARP address rewrite to modify shared file-backed memory without first making the affected packet range writable. CVE-2025-39682: a Linux kernel TLS receive-path logic flaw that mishandles zero-length records queued for later processing, potentially allowing different TLS record types to be processed together when kTLS is in use. CISA says [1, 2] the vulnerabilities have been exploited in attacks but has not revealed any details about the incidents or the nature of the threat actors. Offensive security company STAR Labs found CVE-2025-39964, saying that its researchers found the issue with no help from an AI system. They demonstrated the vulnerability by achieving privilege escalation and container escape in Google’s kernelCTF. For CVE-2025-39682, there are public exploits available, as also confirmed by Red Hat in its security bulletin. Red Hat also confirmed a known exploit available for CVE-2026-53266. Researcher Kimmo Suominen has published a technical analysis and patch-status tracker for CVE-2026-53266 on GitHub, outlining a potential privilege-escalation path involving modifications to file-backed memory. However, the researcher notes that the proposed exploitation chain is inferred by analogy with Dirty Pipe and has not been demonstrated with public exploit code. CISA has marked all three flaws as requiring “forensic triage.” This means that for every affected asset, federal agencies need to examine it for signs that exploitation already occurred. Currently, none of the three flaws is flagged as exploited by ransomware groups. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat