Stolen Keys, Signed Commands: The UpdraftCentral Supply Chain Backdoor

Signed does not mean safe

UpdraftPlus is the most popular WordPress backup plugin. More than four million sites run it. UpdraftCentral manages those sites remotely.

Over the weekend of October 17 and 18, attackers broke into TeamUpdraft's website. They took the customer database and the private keys behind UpdraftCentral.

Then they used those keys the way the keys were designed to be used. They sent commands to connected sites. The commands installed backdoor plugins. Every check on the site passed. The signature was real.

What the researchers saw

Slovak security firm Nethemba found the campaign on its own servers. It published the first detailed analysis on October 19. The attacker had signed commands with keys that had never lived on Nethemba's servers.

Security firm Patchstack watched the campaign run from 15:32 UTC on October 18 to 09:23 UTC on October 19. It counted 99 different malicious plugin names. One recurring backdoor carried the description "Small maintenance toolkit: keeps option storage tidy."

Patchstack rates the impact at 9.8 on the Common Vulnerability Scoring System (CVSS) scale. Some variants create a hidden admin account and a login cookie that skips the login form and two-factor checks.

This is the part that matters. There is no CVE for this. No plugin flaw was exploited. Patching the plugin does not stop it.

What TeamUpdraft did

TeamUpdraft confirmed the breach in a blog post on October 19. It closed the access route, signed out every account, and replaced the exposed keys and credentials. It reported the incident to the United Kingdom's Information Commissioner's Office. Payment data was not stored, so it stayed out of reach.

The company shipped UpdraftPlus 1.26.12 to revoke the old UpdraftCentral Cloud keys. Nethemba's code review found it did not delete them. Versions 1.26.13 and 2.26.13 followed. They remove keys created before 12:07 UTC on October 18.

Keys created between 12:07 and 21:00 UTC that day survive the update. They must be deleted manually. TeamUpdraft's own stated cutoff is 22:00 British Summer Time, which is 21:00 UTC.

The governance lesson

Supply chain attacks are usually described as poisoned updates. This one was different. The delivery channel worked exactly as designed. The trust was real. The holder was not.

Your vendor risk evidence should cover more than the software you install. It should cover the credentials and channels the vendor holds over your systems. Ask who can sign commands into your estate, and what happens if those signing keys are stolen.

Incident evidence here has three parts. First, the key inventory: which systems held a live UpdraftCentral key. Second, the compromise check: unknown plugins, unknown accounts, unknown cookies. Third, the remediation record: update applied, keys rotated, manual deletions done.

Removing the backdoor plugin alone is not enough. Patchstack warns the hidden accounts and cookies can survive plugin removal.

What to do this week

Search your WordPress sites for plugins you did not install. Check the admin user list for accounts you did not create. Update to UpdraftPlus 1.26.13 or Premium 2.26.13.

Then check your key dates. If any UpdraftCentral key was created between 12:07 and 21:00 UTC on October 18, delete it by hand. The update will not do it for you.

Sources

• Security incident disclosure, TeamUpdraft, October 19, 2026. Vendor's primary incident statement.
• "Stolen UpdraftCentral Keys Are Backdooring WordPress Sites," Patchstack, October 19, 2026. https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/
• Campaign analysis, Nethemba, October 19, 2026. First detailed researcher analysis of the campaign.
• Original diagram by PolicyCortex.

Next step

Want vendor-held access mapped across your estate on a schedule? See how PolicyCortex collects the evidence.