Threat reportSupply ChainTL-2026-3995
Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites Following TeamUpdraft Breach
Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites (TL-2026-3995), also tracked as UpdraftCentral key compromise, is a critical-severity supply-chain compromise, first published 2026-10-21 and last reviewed 2026-10-24. It has no confirmed attribution, affects TeamUpdraft UpdraftPlus (UpdraftCentral remote management), references 1 CVE (CVE-2026-10795), maps to 14 MITRE ATT&CK techniques (T1036.005, T1059, T1070), and is covered by 9 detection rules and 45 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 45Indicators of compromise
Key facts for TL-2026-3995
- Threat ID
- TL-2026-3995
- Also known as
- UpdraftCentral key compromise, TeamUpdraft security incident October 2026
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, news - media, retail, education, government administration, small-business
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 45
- Updates
- 2026-10-24 · 2 updates · revalidated 2× · latest source
Malware and tooling in Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
Malware and tooling: PHP
How Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites works
TeamUpdraft's website and customer database were breached on 17-18 October 2026, exposing UpdraftCentral, UpdraftVault and UpdraftClone connection keys along with password hashes and 2FA settings. Attackers used the stolen keys to send correctly signed UpdraftCentral plugin.upload_plugin commands and deployed at least 99 backdoor plugins that create hidden administrator access on an estimated 400,000 exposed WordPress sites.
On the weekend of 17-18 October 2026 an unauthorized party accessed TeamUpdraft's website and customer database. TeamUpdraft states the exposed data included names, email addresses, billing addresses, order history, hashed account passwords, two-factor authentication settings, and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details (processed by Stripe/PayPal), the UpdraftPlus plugin code itself and remote backups were reported as not compromised. Nethemba reports the keys include valid RSA private keys able to sign UpdraftCentral commands; keys do not expire (keys from November 2025 still worked in October 2026, and some from February 2022 were confirmed active).
Using the stolen keys, the attacker sent signed commands over UpdraftCentral's RPC channel (ordinary POST requests to the site root, parsed by class-udrpc.php) with the command plugin.upload_plugin. Patchstack notes the commands were correctly encrypted and signed with genuine dashboard private keys, so every plugin version, including 1.26.11 and 2.26.11, accepts them. The first installation was observed on 2026-10-18 at 15:32 UTC and the last at 2026-10-19 at 09:23, an roughly 18-hour campaign window in which 99 distinct plugin names were deployed. The attacker traffic carried a User-Agent of 'WordPress/6.4; class-udrpc.php' lacking the library version and URL that legitimate dashboard traffic carries, and came from 43.250.53.42 (plus an IPv6 address); Patchstack reports the attacker rotated infrastructure within a single day.
Nethemba documented three backdoor variants. Variant 1 (plugin names like load-stack-35c, text-gantry-eb0) creates an Editor-role account with manage_options and install_plugins capabilities, uses a 32-character token in a URL parameter of the form _ plus 6 hex characters, and contained a fatal PHP bug that crashed some sites (HTTP 500). Variant 2 (single-file plugins such as opt4fix, cache-smith, boost-kit) uses a 12-hex-character trigger parameter; without extra arguments it logs in the first existing administrator, and with m=setup it creates a full administrator and stores its ID in a <slug>_uid option. Variant 3 is a minimal ~673-byte single file (site-health-364f, site-health-cache) that logs in an existing admin or creates a hidden account and hides itself via all_plugins and pre_user_query filters. All variants log the attacker in with wp_set_auth_cookie (14-day remember-me cookie), bypassing 2FA, login limits and security plugins; created accounts survive removal of the plugin. The Patchstack-identified plugin description 'Small maintenance toolkit: keeps option storage tidy.' is the most reliable plugin indicator.
Vendor response: UpdraftPlus 1.26.12/2.26.12 auto-disconnected legacy sessions (but had a bug preventing key removal) and 1.26.13/2.26.13, released 19 October after 10pm BST, revoke old connection keys. Estimated exposure is about 400,000 sites (about 10% of UpdraftPlus's 4+ million installations). CVE-2026-10795 (CVSS 8.1, UpdraftPlus <=1.26.4 UpdraftCentral RPC signature-verification bypass, fixed in 1.26.5 in June 2026) is a separate earlier flaw in the same RPC channel; the sources describe the October campaign as abuse of genuine stolen keys, not exploitation of that CVE. No named threat actor has been attributed.
MITRE ATT&CK techniques used in TL-2026-3995
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1550 Use Alternate Authentication Material; T1564 Hide Artifacts
Execution
T1059 Command and Scripting Interpreter
Command and Control
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship
Persistence
T1098 Account Manipulation; T1136.001 Local Account; T1505 Server Software Component
Privilege Escalation
Credential Access
credential-access
Affected products and versions in Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
- TeamUpdraft — UpdraftPlus (UpdraftCentral remote management)
Vulnerable versions: All versions with active UpdraftCentral keys, including 1.26.11 / 2.26.11 and earlier; CVE-2026-10795: <= 1.26.4
Fixed in: 1.26.13 (free); 2.26.13 (Premium); CVE-2026-10795 fixed in 1.26.5 / 2.26.5 - TeamUpdraft — UpdraftVault / UpdraftClone / TeamUpdraft customer accounts
Vulnerable versions: Customer data and connection keys exposed in 17-18 October 2026 database breach
Fixed in: Keys revoked in UpdraftPlus 1.26.13 / 2.26.13; reconnect with new credentials
Remediation for Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
Patches
- Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later; 1.26.12/2.26.12 has a key-removal bug
- Ensure UpdraftPlus is at 1.26.5/2.26.5 or later to address CVE-2026-10795
Immediate actions
- Delete UpdraftCentral connection keys (Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral, or 'wp option delete updraft_central_localkeys')
- Remove sites from the UpdraftCentral Cloud dashboard and reconnect with new keys only if needed
- Change the teamupdraft.com account password, reset 2FA and revoke all sessions
- Search web access logs for requests with User-Agent containing 'class-udrpc.php' lacking a library version, and for 32-character token URL parameters
- Audit WordPress administrators and any Editor accounts holding manage_options or install_plugins; review wp-content/plugins and mu-plugins for unknown plugins
Workarounds
- Deploy a mu-plugin that returns HTTP 403 when $_POST['udrpc_message'] is set to block UpdraftCentral RPC
- If compromised, delete backdoor plugin folders manually rather than via admin uninstall, remove rogue users and leftover options, and restore from a pre-17-October backup
Longer-term hardening
- Rotate storage credentials (UpdraftVault, remote storage) and all administrator passwords
- Enforce least privilege and restrict remote-management channels to allow-listed sources
- Alert on plugin installations without a matching administrator action and on new users with example.org/example.com emails
- Compare file checksums against clean installations and keep offline backups
CVEs associated with Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
Weaknesses (CWE) in Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
Timeline of Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
- Earliest UpdraftCentral connection keys later found still valid were issued as far back as November 2025 (Patchstack); many sites were enrolled via a default-checked box on TeamUpdraft.com login.
- CVE-2026-10795 (CVSS 8.1), an UpdraftCentral RPC signature-verification bypass affecting UpdraftPlus <= 1.26.4, is published; fixed in 1.26.5. Sources treat it as separate from the October key-theft campaign.
- Unauthorized access to TeamUpdraft's website and customer database begins over the weekend of 17-18 October.
- First backdoor plugin installation via a signed UpdraftCentral plugin.upload_plugin command observed at 15:32 UTC; a probe on one monitored site is sent at 23:10.
- Nethemba and Patchstack publish technical analyses with IOCs; Patchstack deploys mitigation. UpdraftPlus 1.26.13/2.26.13 released after 10pm BST to revoke old connection keys.
- TeamUpdraft discloses the breach; UpdraftPlus 1.26.12/2.26.12 auto-disconnects legacy sessions but has a key-removal bug.
- Last observed backdoor installation at 09:23, ending an ~18-hour window with 99 distinct plugin names deployed; broken Variant 1 plugins crash some sites with HTTP 500.
- TeamUpdraft updates its incident page (16:25 BST): access route closed, vulnerability patched, accounts signed out, credentials and payment provider keys rotated, ICO notified.
- Backdoor trigger attempts from 178.83.37.220, 178.83.37.243 and 178.94.218.31 are seen against sites where the plugins were already removed; BleepingComputer reports ~400,000 potentially exposed sites and TeamUpdraft updates its advisory.
- Analysts warn the 1.26.13/2.26.13 update does not remove installed backdoors or rogue accounts and may leave a gap for keys created 12:07-21:00 UTC on 18 October that require manual deletion.
Update history for TL-2026-3995
- 2026-10-24 — Attackers abuse compromised UpdraftCentral connection keys (TeamUpdraft breach) to plant backdoor plugins on WordPress sites: What changed No severity, exploitability or status change; the newer report rates the incident HIGH versus the existing CRITICAL, and no downgrade is applied. New indicators (13) 5 additional rogue WordPress usernames (system_team850, web.t
- 2026-10-21 — Compromised UpdraftCentral Connection Keys Used to Install Backdoor Plugins on WordPress Sites (TeamUpdraft Breach): What changed No field escalation. The newer report rates severity HIGH versus the existing CRITICAL, so severity is not changed (no downgrades). Exploitability remains ACTIVE. New indicators (16) 6 new SHA-256 hashes (opt4fix, js-fix-757a,
Sources cited for Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
- Stolen UpdraftCentral keys used to backdoor WordPress sites (BleepingComputer)
- TeamUpdraft: Security incident October 2026
- Patchstack: UpdraftCentral key compromise - WordPress backdoors
- Nethemba: Critical security problem in UpdraftCentral - an attacker holding the service's keys planted a backdoor
- Cyber Kendra: Stolen UpdraftCentral Keys Backdoor WordPress Sites
- SecurityOnline: UpdraftPlus Data Breach Leads to UpdraftCentral Backdoor Attacks on WordPress Sites
- WP Umbrella: UpdraftPlus Backdoor Attack - What Happened and How to Protect Your Sites
- NVD: CVE-2026-10795 (UpdraftPlus UpdraftCentral RPC authentication bypass)
- Wordfence: UpdraftPlus <= 1.26.4 Unauthenticated Authentication Bypass via UpdraftCentral UDRPC
Detection coverage for TL-2026-3995
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3995 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.