Stolen UpdraftCentral dashboard keys used to push backdoor plugins to connected WordPress sites
An attacker holding valid UpdraftCentral dashboard private keys installed backdoor plugins on connected WordPress sites in an 18-hour campaign on 18-19 October 2026. Patchstack telemetry shows installations across a broad set of sites between 18 Oct 15:32 and 19 Oct 09:23 UTC. This is not a vulnerability in UpdraftPlus: the commands are c…