Threats & Breaches
Stolen UpdraftCentral Keys Backdoor WordPress Sites, and the Vendor’s Fix Leaves a Gap
TeamUpdraft says exposed cloud connection keys were revoked in UpdraftPlus 1.26.13/2.26.13, but Nethemba found the fix misses keys created in a nine-hour window on October 18. Every connected site needs a manual key deletion and full audit.