Over the weekend of October 17 and 18, someone broke into the website of TeamUpdraft, the company behind the UpdraftPlus backup plugin for WordPress. By October 18, the attackers were putting their haul to work.
Part of that haul was the customer database, including the connection keys that let a cloud dashboard manage customer websites remotely. Patchstack says attacks using those keys began at 15:32 UTC on October 18. BleepingComputer reports that about 10% of UpdraftPlus sites may have held such a key, which puts around 400,000 sites in range.
Here is how it played out. The attackers sent commands signed with real keys, and the websites said yes. The commands installed plugins with names like “Site Health Cache” and descriptions like “Small maintenance toolkit: keeps option storage tidy.” Patchstack has logged at least 99 of them. More creativity went into naming these plugins than most companies put into naming their products. Wordfence reports the commands worked even on sites already patched for an earlier UpdraftPlus flaw, because a valid key looks like a valid boss.
Site owners can search their logs for this line:
“Command received: plugin.upload_plugin”
Your own supply chain
Most people don’t run a WordPress site, and everyone still has a version of this story. Your email provider, password manager, phone apps, cloud backups, and every store that saved your card each hold a piece of you. Try this: list the apps on your phone you haven’t opened this year. That list is your vendor roster, and each name on it is a company that can be breached on a weekend without telling you first.
Even official update channels have carried trouble. A 2026 roundup of WordPress incidents reports that a build pipeline compromise at plugin maker ShapedPlugin put a backdoor into official Pro releases. Updating promptly is still good practice. Owning fewer things to update is better practice.
The good news is that this is the one part of the chain you control. Every vendor you drop is a breach you can’t be part of.
IntelTechniques publishes a free Credential Exposure Removal Guide for the cleanup side. It explains that breach data containing emails, usernames, and passwords gets widely shared, and that some lookup services sell access to it. It walks through removal requests for services including Have I Been Pwned, Dehashed, Leakcheck, IntelX, HudsonRock, Leak-Lookup, HackCheck, Breach Directory, and LeakPeek. The page calls itself step four of a four-step process and links the other three: data requests, credit freezes, and data removal. It also says removal won’t erase your credentials from the original breaches or from copies already circulating, and its closing advice is to change any exposed credentials immediately.
Spot it early
- Breach notices attract imitators. After a real breach, fake “your account was affected” messages tend to follow (this is inference). Skip the link, type the company’s address into your browser, and read the notice there.
- Anyone “helping” with your account who asks for a password or code. Ask the caller to verify themselves first and watch how quickly the “security team” remembers a meeting.
- Plugins, users, or apps you don’t remember adding. Look them up, and remove the ones with no good answer.
- Apps asking for contacts, photos, microphone, or constant location with no reason to. Say no, or delete the app.
What to do today
Start with the thirty-minute version.
- Change exposed passwords and make each one different. Check your email addresses at haveibeenpwned.com, then use a password manager to change anything flagged. Do this before any removal requests, since the IntelTechniques guide notes removal doesn’t erase the original breach.
- Upgrade your sign-in. Turn on passkeys where offered, or an authenticator app in place of text messages, for email, banking, your password manager, and your Apple or Google account.
- Freeze your credit. It’s free at Equifax, Experian, and TransUnion, and it blocks most new-account fraud that follows a breach.
- Turn on your phone’s privacy settings. Switch off ad tracking and ad personalization, set location to “while using” or “ask,” and review which apps can reach your contacts, photos, and microphone.
- Delete apps you don’t use. Keep what you open, install only from the official app store, and turn on automatic system updates.
Then, when you have an afternoon:
- Close old accounts. Search your inbox for “welcome” and “verify your email” messages to find them. Data a company no longer holds can’t leak.
- Use a separate email address or alias for shopping and sign-ups. One address per purpose limits what a single breach reveals.
- Trim stored payment cards. Remove cards from stores you rarely use, and pay with a credit card rather than a debit card online.
- Work through the IntelTechniques four-step process. It covers data requests, credit freezes, data removal, and the credential removal requests above.
- If you run a WordPress site with UpdraftPlus: update to 1.26.13 (free) or 2.26.13 (premium) or later, and delete all UpdraftCentral keys inside the site’s own dashboard under Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral. Reset your TeamUpdraft password and 2FA from a clean device. Check for plugins and administrator accounts you don’t recognize. If you find any, restore from a backup made before October 17, or bring in incident response help.
- If money or accounts were already taken: call your bank or card company and report it at ReportFraud.ftc.gov. Then tell someone you trust.
Sources:
BleepingComputer, Oct 20, 2026: https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/
Wordfence advisory, Oct 19, 2026 (read via malware.news mirror): https://malware.news/t/psa-updraftcentral-connection-key-compromise-used-to-install-malicious-plugins-on-wordpress-sites/126539
WPPoland, “WordPress supply chain attacks 2026,” published Jun 20, updated Oct 20, 2026: https://wppoland.com/en/wordpress-supply-chain-attacks-2026/
IntelTechniques, Credential Exposure Removal Guide: https://inteltechniques.com/exposure