SecurityThe Hacker Newsabout 2 hours ago
Hackers Abuse Keys to Backdoor WordPress Sites
7 min read
Unknown attackers breached TeamUpdraft's website on October 18, 2026, stealing keys for UpdraftCentral to install backdoors on over four million WordPress sites. The incident, assigned CVE-2026-111862 with a CVSS score of 9.8, allowed actors to create administrator accounts and upload malicious plugins. Patchstack observed 99 distinct backdoor plugin names during the attack, which ran for 18 hours.
Level
Hype check
Tap to vote and see what everyone thinks.