Act
active
Stolen UpdraftCentral keys used to backdoor WordPress sites
- Engineer — Act: Active supply-chain compromise: stolen UpdraftCentral connection keys give attackers remote command execution over any connected WordPress site. Immediately rotate all UpdraftCentral connection keys and audit connected WordPress sites for unauthorized files, new admin accounts, or modified plugins.
- SOC/IR — Act: Sites connected to UpdraftCentral may already be backdoored; sweep WordPress environments for unexpected file changes, newly created admin accounts, or outbound C2 traffic since the TeamUpdraft breach, even without published IOCs.
- Leader — Act: A developer managing popular WordPress backup plugins was breached, with active backdooring of customer sites reported. Confirm this week whether any organizational WordPress properties use UpdraftCentral, and if so request an incident summary from TeamUpdraft to assess exposure.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.