A threat actor breached TeamUpdraft's website, potentially compromising UpdraftCentral connection keys used to send commands to connected WordPress sites. The breach was detected over the weekend of 17-18 October.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
The incident could result in significant operational disruptions for affected websites, as attackers may use stolen keys to backdoor sites and add full administrator accounts. The vendor recommends rotating storage credentials and reauthorizing connections.
Industries affected
The incident affects users of self-hosted WordPress sites, particularly those using UpdraftCentral for remote management.
Users affected
UpdraftCentral users, especially those managing multiple sites, are at risk. The breach may expose around 400,000 websites to potential backdoor attacks.
Build these skills
Watch the daily brief
Sources
- Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites (The Hacker News)
- Stolen UpdraftCentral keys used to backdoor WordPress sites (BleepingComputer)
- WordPress sites compromised after TeamUpdraft credential exposure (CSO Online)
