Hacking still active?

  • wiha0webmaster

    (@wiha0webmaster)


    1 week, 6 days ago

    Last Monday I was victim to the hacking on two of my sites as a user of Updraft backup. A new admin user was created and installed malicious plugins on two sites. I was able to fix this and went through all the steps the Team Updraft page listed: https://teamupdraft.com/blog/security-incident-october-2026/ (except for reconnecting Updraft Central – I had not done that yet, as the backups still showed as live each of my four pages).

    Today I got a notification on a third site that a new admin was added – with the a similar username (svc5wmkhqxwm; on my other sites it always started with svc and the email always ended with @example)

    I was able to login to the page today and delete the user, delete the two plugins, restore my plugins folder to what it was on 10/06, and then login to Updraft – but I’m wondering if there’s still some error with this plugin that they were able to get in? My history plugin shows a known admin created the new user yesterday – so they were able to access information to login as that known admin – and then create an account for themselves.

    Are there any other steps I should be taking? Or is there a known second round of breach?

    Thanks

    The page I need help with: [log in to see the link]

Viewing 8 replies - 1 through 8 (of 8 total)
  • isa64

    (@isa64)

    1 week, 6 days ago

    Same here.
    1 admin user created on 2 of my sites by malicious plugin (random names).My sites are no longer connected to Updraft Central since October 19th.
    I deleted users and plugin but wonder if Updraft Plus is safe…
    I’m a premium user since a long time and use it on all of my 40 sites.

    Thread Starter wiha0webmaster

    (@wiha0webmaster)

    1 week, 6 days ago

    @isa64 Have you contacted support as a premium user? I’m not a premium user so I haven’t been able to.

    isa64

    (@isa64)

    1 week, 6 days ago

    not yet
    I’m checking my other sites and let you know

    Plugin Contributor bcrodua

    (@bcrodua)

    1 week, 5 days ago

    Hi,

    @isa64 , since you have an active Premium licence, please contact us directly through our Premium support form: https://teamupdraft.com/support/premium-support-form/

    Please ensure that you’re running the latest version of UpdraftPlus and that all existing UpdraftCentral connection keys have been removed.

    We also recommend reviewing your administrator accounts, plugins (including must-use plugins), and website files for any remaining suspicious activity. Since unauthorized access appears to have occurred again, we strongly recommend working with your hosting provider to investigate any possible remaining backdoors or compromised credentials.

    You can find our latest official information and security recommendations here: https://teamupdraft.com/blog/security-incident-october-2026/

    We apologize for the concern this has caused and appreciate your patience while the investigation continues.

    Kind regards,
    Bryle

    Thread Starter wiha0webmaster

    (@wiha0webmaster)

    1 week, 4 days ago

    @bcrodua I’m not a premium user, but still impacted by this major security incident. I had followed all steps listed on the site – except for relinking my site with updraft central (given that your site said all were disconnected – so I was waiting to relink). But even after doing all of those steps, there were still unauthorized users and two bad plugins installed on one of my sites (a different one than the two that had previously been impacted). This happened 2 days ago – after you had disconnected everything, after I had changed passwords, etc. So how can I know whether this security incident is secured? Or what else can I do to protect my site?

    Plugin Support vupdraft

    (@vupdraft)

    6 days, 10 hours ago

    Hi

    Please follow the advice in this post: https://teamupdraft.com/blog/security-incident-october-2026/

    motiberman

    (@motiberman)

    2 days, 13 hours ago

    A third site getting the same svc… admin pattern usually means something left behind (plugin, mu-plugin, or credential) rather than a brand-new Central session. Over SFTP, remove every unknown folder under wp-content/plugins/ and wp-content/mu-plugins/ by deleting the folders on disk — not only from the Plugins screen — then remove unrecognized admins and rotate WordPress, hosting, SFTP, and database passwords, and shuffle salts in wp-config.php. TeamUpdraft’s current checklist still applies, including sites that looked clean after the first round: https://teamupdraft.com/blog/security-incident-october-2026/ Ask your host for access logs around the day the new admin appeared so you can see how that known account was used.

    motiberman

    (@motiberman)

    2 days, 13 hours ago

    Treat every site that was ever linked to UpdraftCentral as in scope, not only the two that showed the new admin. Delete remaining Central keys from each site’s UpdraftPlus Advanced Tools, compare plugins and mu-plugins to a known-good list over SFTP, and rotate admin and host credentials even after you disconnected Central. Updating the plugin alone does not remove malware that was already planted. As a Premium user you can take private evidence through TeamUpdraft’s Premium support form: https://teamupdraft.com/support/premium-support-form/

Viewing 8 replies - 1 through 8 (of 8 total)

You must be logged in to reply to this topic.