Stolen UpdraftCentral keys expose connected WordPress sites to remote commands

Stolen UpdraftCentral keys could let attackers send commands to connected WordPress sites. Rotate keys and audit sites now.

• BleepingComputer reports that TeamUpdraft's website was breached and UpdraftCentral connection keys may have been stolen.
• Affected: WordPress sites connected to UpdraftCentral; the source does not specify which organizations or how many sites are involved.
• Impact: stolen keys could let an attacker send commands to connected sites; rotate keys and audit for compromise now.

What to do now

1. Inventory every WordPress site connected to UpdraftCentral, including vendor-managed sites, and record who administers each connection.
2. Revoke and rotate all UpdraftCentral connection keys, API tokens, and stored credentials; disconnect sites from the service until TeamUpdraft confirms it is clean.
3. Audit each site for rogue administrator accounts, unexpected scheduled tasks, modified core/plugin/theme files, and unfamiliar outbound connections.
4. Review web server, hosting, and UpdraftCentral logs for remote commands or connections from the management service; preserve evidence before cleanup.
5. Rebuild confirmed compromised sites from a known-good backup, reapply updates and new credentials, restrict management access to trusted networks, and monitor TeamUpdraft advisories.

Related items

• Stolen UpdraftCentral keys used to backdoor WordPress sites