Nethemba | We care about your security

We care about
your security.

Nethemba is a leading Slovak IT security firm specialized in web security, penetration testing, and RFID security audits. Since 2007, we’ve been securing businesses with cutting-edge research and expertise, trusted by companies worldwide.

We care about
your security.

Nethemba is a leading Slovak IT security firm specialized in web security, penetration testing, and RFID security audits. Since 2007, we’ve been securing businesses with cutting-edge research and expertise, trusted by companies worldwide.

BLOG

Critical security problem in UpdraftCentral: an attacker holding the service’s keys planted a backdoor on our websites

On the night of 19 October 2026 an attacker abused UpdraftCentral, the remote management service built into UpdraftPlus, a backup plugin with more than 4 million installations, and planted a backdoor on two of our three websites. Our sites were fully up to date and the fault was not on our side: the attacker signed the commands with valid keys that the UpdraftCentral Cloud service generates and keeps. We publish an analysis of the backdoor, indicators of compromise and a...

Read More

Facebook

Nethemba
Nethemba2 days ago
If you run WordPress with UpdraftPlus and your site is connected to UpdraftCentral, please delete the UpdraftCentral key today and check the site.

On the night of 19 October an attacker sent validly signed UpdraftCentral commands to three of our WordPress sites and installed a backdoor plugin on two of them. The sites were fully up to date, on UpdraftPlus 2.26.11, patched against the June vulnerability CVE-2026-10795. The attacker did not break into our servers. The commands were signed with the private dashboard keys that UpdraftCentral Cloud generates and keeps, keys that never existed on our side.

The backdoor waits for a secret link, then creates an account that looks like an ordinary Editor but can change every setting and install plugins, and logs the attacker straight in, bypassing the login form and two-factor authentication. A bug in its code made it crash our sites instead of working. A fixed version would take a few characters.

UpdraftPlus has more than 4 million active installations and every copy contains the UpdraftCentral client. Any site connected to UpdraftCentral is exposed, including the latest version. There is no fix yet.

What to do now:
• delete the key in UpdraftPlus > Advanced Tools > UpdraftCentral
• check the site with our free read-only WP-CLI script
• do not reconnect until TeamUpdraft explains how the keys leaked

We reported it to TeamUpdraft the same day. Because the attack is active and publishing gives the attacker nothing new, we are publishing the analysis, indicators of compromise and the checker right away:
https://nethemba.com/updraftcentral-backdoor-analysis/

#WordPress #infosec #UpdraftPlus #cybersecurity
Nethemba
Nethemba2 days ago
#89 Jarvis (HackTheBox) (Medium) How To Deal With Connection Issues...
SQL injection (involving a WAF bypass) allows us to write a shell in the webserver root. We then abuse a custom python application to gain more rights as another user. Finally systemctl with SUID rights grants us root access after a period of losing my mind.

https://www.youtube.com/watch?v=BoChqSyOi48
Nethemba
Nethemba2 days ago
Praxeológia súkromia: Ekonomická logika v cypherpunkovej implementácii
Max Hillebrand · Slovenský preklad tretieho vydania
https://towardsliberty.com/pop/sk/