Cyber Threat Brief — October 19 2026
⚠️ This report is AI-generated. Always validate findings.
1. UpdraftCentral-2026-10 — stolen dashboard keys installing WordPress backdoors
TL;DR: An attacker with valid UpdraftCentral dashboard keys is pushing backdoor plugins to connected WordPress sites, and no UpdraftPlus release stops a command those keys sign. Delete every UpdraftCentral key on the site itself, then look for the plugin description and the two accounts below.
What’s New:
- Patchstack and Nethemba both recorded signed
plugin.upload_plugincommands on 18–19 October. This is a stolen-key incident, not a flaw in the plugin. Free 1.26.11 and premium 2.26.11 / 2.26.11.26 still execute the commands. Team Updraft had not published an explanation when those writeups went live. - The backdoor is supposed to create an Editor that also holds
manage_optionsandinstall_plugins, then set a login cookie so two-factor authentication never runs. The samples analyzed so far crash on PHP 8 before that check, which returns HTTP 500. Do not repair the plugin. Repairing it turns the backdoor on. - The key that matters lives in the site option
updraft_central_localkeys. Removing the site from the UpdraftCentral dashboard does not delete it. Backups keep working after the key is gone. Keys do not expire. Patchstack saw November 2025 keys still accepted in October 2026. - Sites still on UpdraftPlus 1.26.4 / premium 2.26.4 or older also face CVE-2026-10795, which forges commands with no key at all. That bug was fixed in 1.26.5 / 2.26.5 and is a separate problem from this campaign.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
WordPress option updraft_central_localkeys | Remote-management key | T1078.002 | WP-CLI / wp_options | Run wp option delete updraft_central_localkeys, or in wp-admin open Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, and delete every key. Any value means the site will run commands signed by the stolen dashboard key. |
IP 43.250.53.42 | Source address | T1071.001 | Web server access log | Search access logs for 43.250.53.42 sending POST /. Nethemba and Patchstack both saw this address deliver plugin.upload_plugin. Treat a hit as a push attempt, then block the address only as a supplement to deleting the key. |
IPv6 2a09:bac5:4e21:2e3c::49b:9 | Source address | T1071.001 | Web server access log | Search access logs for 2a09:bac5:4e21:2e3c::49b:9. Patchstack telemetry saw this address about three hours before 43.250.53.42. The attacker rotated within a day, so an IP block is not the control. |
User-Agent WordPress/6.4; class-udrpc.php | HTTP client | T1071.001 | Web server access log | Alert on POST / whose User-Agent is exactly WordPress/6.4; class-udrpc.php. The real dashboard sends class-udrpc.php/2.0 and https://teamupdraft.com in the same header. This string has neither. |
Query parameter _ plus 6 hex characters and a 32-character token | Activation trigger | T1505.003 | Web server access log | Search the access log for [?&]_[A-Za-z0-9]{4,10}=[A-Za-z0-9_]{32}. Nethemba’s samples use _9f5696 and _3e9caa. A hit means the backdoor was used. Treat the site as fully compromised. |
Plugin description Small maintenance toolkit: keeps option storage tidy. | Backdoor file marker | T1505.003 | File search on the web root | Search plugin trees for Small maintenance toolkit: keeps option storage tidy. Patchstack says every sample carries that sentence, while the folder name changes. Quarantine the directory. Do not edit it back into working PHP. |
Plugin name Site Health Cache | Backdoor plugin | T1505.003 | Plugin list / file inventory | Search the plugin list and plugin directories for Site Health Cache. Patchstack says that is the one name reused repeatedly among 99 observed names, and the strongest name-based indicator. A miss does not clear the site. Quarantine the directory. Do not edit it back into working PHP. |
Plugin directory wp-content/plugins/load-stack-35c/ | Backdoor plugin | T1505.003 | File inventory / web access log | If wp-content/plugins/load-stack-35c/ exists, move it out of the web root. Nethemba’s first site received it at 04:14:30 CEST on 19 October from 43.250.53.42. Deleting it in wp-admin runs uninstall.php, which erases the plugin’s options. |
Plugin directory wp-content/plugins/text-gantry-eb0/ | Backdoor plugin | T1505.003 | File inventory | If wp-content/plugins/text-gantry-eb0/ exists, move it out of the web root the same way. Nethemba’s second site received this copy. The generator changes the folder name per site, so a miss here does not mean the site is clean. |
Database option <plugin_slug>_sync_token | Backdoor marker | T1505.003 | wp_options | Search wp_options for <plugin_slug>_sync_token, including load_stack_35c_sync_token and text_gantry_eb0_sync_token. Nethemba’s check matches ^[a-z]+_[a-z]+_[0-9a-f]{3}_ followed by sync_token or setup_stamp. Preserve the row, then delete it. |
SHA-256 3c3355f7692d4951e5655683783795579467c9bf1ae2152e13b8c80e9021209f | File hash | T1505.003 | EDR file inventory | Block and sweep for 3c3355f7692d4951e5655683783795579467c9bf1ae2152e13b8c80e9021209f, the main file of the load-stack-35c sample. |
SHA-256 bb40f9a87cea678aa50e5286dd91c0903d6a7fc1b12391472187a0919b4d0801 | File hash | T1505.003 | EDR file inventory | Block and sweep for bb40f9a87cea678aa50e5286dd91c0903d6a7fc1b12391472187a0919b4d0801, the main file of the text-gantry-eb0 sample. |
SHA-256 4186ae2aa0472a4e7929b21bb87f9b61866cb3790f69f4b6c9813e196955d5f0 | File hash | T1505.003 | EDR file inventory | Block and sweep for 4186ae2aa0472a4e7929b21bb87f9b61866cb3790f69f4b6c9813e196955d5f0, uninstall.php from the load-stack-35c sample. |
SHA-256 4943fc21efa4b81516130f92bf4efe3b832e1bb69e499d2e42587233a0a005e9 | File hash | T1505.003 | EDR file inventory | Block and sweep for 4943fc21efa4b81516130f92bf4efe3b832e1bb69e499d2e42587233a0a005e9, uninstall.php from the text-gantry-eb0 sample. |
Username data-ops43 | Backdoor account | T1136.001 | wp_users | Delete the user data-ops43 if present. Nethemba’s first sample would have created it with email [email protected] and display name Site Tools, as Editor plus manage_options and install_plugins. The account survives plugin removal. |
Username media-staff96 | Backdoor account | T1136.001 | wp_users | Delete the user media-staff96 if present. It is the account name in Nethemba’s second sample, with the same Editor-plus-capabilities pattern and an @example.org address. |
Display name Site Tools | Backdoor account marker | T1136.001 | wp_users | List users whose display name is Site Tools and remove them. The login name changes per site. The two public names are data-ops43 and media-staff96, and Patchstack says other names exist. |
Log string Command received: plugin.upload_plugin | UpdraftCentral client log | T1505.003 | Database option updraftcentral_client_log | Search updraftcentral_client_log for Command received: plugin.upload_plugin. The option keeps about the last 50 events, so also search the web access log if the line has rotated out. |
Host string probe.central.updraftplus.com | UpdraftCentral probe | T1071.001 | Database option updraftcentral_client_log | Search updraftcentral_client_log for probe.central.updraftplus.com. Nethemba saw this probe, sent to a key that does not exist, a few hours before plugin.upload_plugin on the real key 0.central.updraftplus.com. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | WordPress Bricks Builder plugin RCE matches a different plugin URL. No rule keys on class-udrpc.php or updraft_central_localkeys. |
| Elastic | Partial — PHP File Creation in WordPress Plugin Directory | Fires when php-fpm, Apache, nginx, or a shell writes any file under wp-content/plugins/. It also fires on a normal plugin install, and it does not see the description string. |
| Sigma | None — verified | Linux Webshell Indicators requires children such as whoami or cat. These samples fatal inside PHP and do not spawn that child. |
Detection index: ESCU 1391417 (2026-10-19) · elastic detection-rules a61fa31 (2026-10-16) · SigmaHQ f083329 (2026-10-19).
Hunt hint: Delete the key first, or the next push can replace a broken plugin with a working one. Then run wp option get updraft_central_localkeys even on sites that only use UpdraftPlus for backups, because the TeamUpdraft account screen ticks the UpdraftCentral checkbox by default. Search users for display name Site Tools or an email ending in @example.org, and for any non-administrator whose capabilities include both manage_options and install_plugins. A WordPress mail about a plugin you did not install, plus HTTP 500 on uncached requests, matches the PHP 8 crash Undefined constant <Class>::FIELD. If that account exists, or the access log shows its URL parameter, restore the site from a backup taken before the attack (Patchstack’s earliest observed install was 18 October 15:32, time zone not stated) and rotate administrator and UpdraftCentral Cloud passwords. Until Team Updraft explains the leak, do not create a new key. Nethemba published a read-only check script and an optional mu-plugin that returns 403 on any POST with udrpc_message to block UpdraftCentral commands until the vendor explains (this also blocks UpdraftPlus Migrator).
Sources: Patchstack · Nethemba · Oliver Sild (Patchstack) · Nethemba on X
Status Updates
- CVE-2026-102764 (BeyondTrust Remote Support): KEV due today, Oct 19. Forensic triage still required. No public PoC. Self-hosted 26.2.3 and older need the BT26-05-RS patch. Original brief.
- CVE-2025-61624 (FortiOS auto-script path traversal / PEERSTITCH): KEV due today, Oct 19. Forensic triage still required. Original brief.
- CVE-2026-21589 (Atlassian Data Center file read): KEV due date was Oct 18 and is now overdue. Forensic triage still required. Original brief.
- KEV deadlines already passed, no new fix or IOC: CVE-2026-0322 (PAN-OS) and CVE-2026-76519 (Cisco Secure Email Gateway; AsyncOS 16.0 still has no fixed build, so migrate to 15.5.5-014 or 16.5.0-780, or confirm Content Scanner Tools 25.3.0.5525 or later) (brief); CVE-2026-105134 and CVE-2026-105133 (AhsayCBS) (brief); CVE-2026-104935 (Ivanti) and CVE-2026-96951 (Windows Shell) (brief); CVE-2026-86950 (Apple CoreGraphics) (brief).
- GhostAction-2026-10: OpenSourceMalware’s 16 October note adds a second stage on 94 repositories:
.vscode/tasks.jsontaskeslint-checkrunspublic/fonts/fa-solid-400.woff2, and a crontab line commented#ghc2calls193.32.204.199:8080. Deleting the workflow does not remove that cron entry. Original brief. - Deferred, PwnEscape CVE-2026-99999: Risky Bulletin restates the kernel fix. No in-the-wild claim and not in KEV. Recheck Oct 22.
- Deferred, BlockStrap CVE-2026-103849: Sansec’s teardown still says no attacks on live stores. An aggregator post claiming Magecart use is unverified and contradicts Sansec. Not in KEV. Recheck Oct 22.
- Deferred, new: SiteGuard CVE-2026-106931 (vendor-only exploitation claim, fixed in 8.00 Update 5 / FreeBSD 7.00 Update 6, recheck Oct 20); Rank Math SEO Pro 3.0.123 (vendor notice not retrieved; recheck Oct 20); Plex2Shell CVE-2026-96652 / CVE-2026-96654 / CVE-2026-96655 / CVE-2026-96656 (honeypot claim is one origin; fixed in 1.43.3.10861; recheck Oct 21); APT28 Covenant Grunt
.docmcluster (Nextron writeup not retrieved; recheck Oct 20); Heartbreaker macOS sample (Objective-See only; recheck Oct 22). - Deferred, carried: Langflow CVE-2026-105740, Redis CVE-2026-25243, npm
imgdecode, and the OpenCode Console key rotation (Oct 20); Drupal SA-CORE-2026-014 / CVE-2026-108097 (Oct 21). - Retired from watch (last update 2026-10-12): CVE-2026-0257 (KEV due 2026-06-01, no material change since 2026-10-12).
- Retired from watch (last update 2026-09-29): GHSA-qx49-fqc8-xw99.
- Retired from watch (last update 2026-09-28): Carbonato, CVE-2026-62062.
- Retired from watch (last update 2026-09-27): CVE-2026-18143, MiniShaiHuludActions.
- Retired from watch (last update 2026-09-26): CVE-2026-48842.
- Retired from watch (last update 2026-09-25): CVE-2026-61674.
- Retired from watch (last update 2026-09-24): CVE-2026-80521.
- Retired from watch (last update 2026-09-23): BlueMoon, CVE-2026-85103.
- Retired from watch (last update 2026-09-22): CVE-2026-32996, CVE-2026-93485, Click2Shell.
- Retired from watch (last update 2026-09-21): ChainScript, JadeSleet, indexed-btree.
- Retired from watch (last update 2026-09-20): WaterPlum, CVE-2026-32882.
- Retired from watch (last update 2026-09-19): CVE-2026-58138, CVE-2026-28326.
- Retired from watch (last update 2026-09-18): BrevoClickFix, CVE-2026-91843, CVE-2026-81642.
- Retired from watch (last update 2026-09-16): CVE-2026-27540, CVE-2026-90894.
- Retired from watch (last update 2026-09-15): CVE-2026-51990.
- Retired from watch (last update 2026-09-13): Storm-3121, CVE-2026-86793.
- Retired from watch (last update 2026-09-09): PoisonedRefresh, ShieldCrash.
- Retired from watch (last update 2026-09-05): FalconFlank, CVE-2026-6471.
- Retired from watch (last update 2026-09-04): CVE-2026-20212, CVE-2026-84645.
- Retired from watch (last update 2026-09-03): CVE-2026-32475, CVE-2023-54391.
- Watching (no change): ConnectWise-CloudBackup-SkyKick-2026-10 (10-17); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); CVE-2026-110447 (10-15); CVE-2026-102255 (10-15); Danfoss-AKSM-FROMAGEGATE-2026-10 (10-13); CVE-2026-97229 (10-13); CVE-2026-85097 (10-09); CVE-2026-107406 (10-09); CVE-2026-82077 (10-11); CVE-2026-61500 (10-04); CVE-2026-88062 (10-04); CVE-2026-86360 (10-06); ClickFix-CacheSmuggle-2026-10 (10-07); CVE-2026-102406 (10-07); CVE-2026-103007 (10-07); FortiBleed-2026-10 (10-08); tensorlake-npm-0.5.144 (10-08); CVE-2026-105192 (10-08); CyberXero-2026-10 (10-12).