TeamUpdraft, a developer of popular WordPress backup and security plugins, disclosed a security breach of its website that occurred over the weekend of October 17-18. The unauthorized access potentially compromised UpdraftCentral connection keys, which attackers could use to send commands to connected websites. The company’s investigation revealed that hackers accessed its customer database, including password hashes, two-factor authentication settings, and connection keys for multiple services. Payment details were not stored and remain secure.
Security researchers estimate approximately 400,000 WordPress websites could be affected, as roughly 10 percent of UpdraftPlus users have UpdraftCentral or Migrator keys. Attackers have already begun exploiting the stolen keys to install backdoor plugins on compromised sites, with at least 99 distinct malicious plugins identified. TeamUpdraft recommends users update to the latest version, delete UpdraftCentral connection keys, and monitor their sites for signs of compromise. If breaches are confirmed, administrators should restore from clean backups and reset account security credentials.
Our take: Many site owners had one of these keys without knowing it, and updating does not remove a backdoor that is already there. Read the Commentary: A Backup Plugin’s Remote Control Was Stolen. You May Have One Without Knowing It.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
