Stolen UpdraftCentral keys install backdoor plugins on WordPress sites

🚨 ACTIVE EXPLOITATION

• Stolen UpdraftCentral keys used to install backdoor plugins on WordPress sites
  Attackers using stolen UpdraftCentral dashboard keys are installing backdoor plugins on connected WordPress sites.
  • Affects all UpdraftPlus versions (free and premium, including 1.26.11 and 2.26.11.26) on sites with an active UpdraftCentral key; over 4 million installations
  • Not a code vulnerability: commands are correctly signed with genuine stolen dashboard private keys, so all plugin checks pass; no vendor fix exists as of 19 October 2026
  • Attackers send a signed plugin.upload_plugin command via POST requests to the site root; evidence points to keys leaking from the UpdraftCentral Cloud environment
  • The backdoor plugin watches for a secret URL parameter with a 32-character token, creates a hidden Editor account with a hardcoded password, grants manage_options and install_plugins, and logs in via cookie, bypassing 2FA and login protection
  • Campaign ran ~18 hours from 18 October 15:32 to 19 October 09:32; samples contained a coding error causing HTTP 500 errors on uncached requests; the account persists even after plugin removal
  Sources 📄 Source: nethemba.com · 📎 Coverage: patchstack.com · 👁 via patchstack.com (discovered)

💥 BREACHES & INCIDENTS

• H2O Retailing breach may expose data of 1.26 million H2O ID members via Hankyu Hanshin reservation site
  H2O Retailing reported unauthorized access that may have leaked personal data of about 1.26 million H2O ID members.
  • Affects H2O ID members of H2O Retailing and subsidiary Hankyu Hanshin Department Stores — nearly the entire membership base of roughly 1.26 million accounts.
  • Unauthorized access on October 16 reached the customer management system via the Hankyu/Hanshin Department Store Reservation Site; HANKYU HANSHIN E-STORES and Remo Order were hit on October 17 and all systems were suspended.
  • Potentially leaked data includes names, email and mailing addresses, phone numbers, birthdates, ages, gender, and service usage; the shopping sites also hold some credit card details (last four digits, cardholder names, expiration dates) under investigation.
  • No fraudulent use or secondary damage confirmed so far; the company has reported to Japan's Personal Information Protection Commission and filed a police report.
  • The breach is part of a surge in Japanese data leaks — 454 reported January–September, with 19 cases involving at least 1 million records by mid-October.
  Sources 📄 Source: asahi.com · 📎 Coverage: finance.biggo.com · 👁 via @metacurity@infosec.exchange

🔓 CVEs & KEV

• CVE-2026-88901 — Apache Software Foundation Apache Camel — CVSS 8.2 — Apache Camel: Camel-Smooks XML External Entity Processing, external entities ...

• CVE-2026-85251 — Apache Software Foundation Apache Camel — CVSS 7.5 — Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets...

• CVE-2026-85250 — Apache Software Foundation Apache Camel — CVSS 7.5 — Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure ...

• CVE-2026-85314 — Apache Software Foundation Apache Camel — CVSS 6.5 — Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in...

• CVE-2026-85296 — Apache Software Foundation Apache Camel — CVSS 6.5 — Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Re...

• CVE-2026-85254 — Apache Software Foundation Apache Camel — CVSS 6.5 — Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by...

• CVE-2026-85249 — Apache Software Foundation Apache Camel — CVSS 6.5 — Apache Camel: Camel-Tika Header Injection via Unfiltered Document MetadataImp...

🕵️ RESEARCH & DEEP DIVES

• Pegasus spyware found on devices of Serbian university rector and prosecutor ahead of elections
  Researchers confirmed Pegasus spyware infections on devices of prominent Serbian government critics weeks before parliamentary elections.

  • Targets include University of Belgrade rector Vladan Đokić, a backer of student anti-corruption protests, and Rade Bajić, a prosecutor involved in a Trump-linked Belgrade hotel corruption case
  • Citizen Lab found with high confidence that Đokić's device was infected with NSO Group's Pegasus in 2026 via a zero-click exploit requiring no user interaction
  • Bajić received an Apple threat notification; the specific spyware on his device has not yet been identified
  • The cases follow a September SHARE Foundation report of 14 people, including an MP and local official, targeted with Pegasus and a new NoviSpy Android spyware variant
  • Serbia's Oct. 25 parliamentary elections come amid the largest protest movement against President Vučić's rule in years
  Sources 📄 Source: citizenlab.ca · 📎 Coverage: cyberscoop.com · 👁 via CyberScoop

• DHS appointees secretly asked CISA to acquire and hack a voting machine, report says
  DHS political appointees asked CISA to secretly acquire and hack a voting machine, a request staffers called impossible and refused to act on.

  • Applies to CISA, the DHS agency responsible for protecting US election infrastructure, and state election officials nationwide.
  • Political appointees wanted CISA to procure a voting machine, hack it, and report findings to the White House, without notifying the vendor of any flaws discovered.
  • CISA staffers said the operation was impossible partly because agents capable of it had been laid off under DOGE; the appointees eventually stopped pressing.
  • The request came as CISA lost over 1,000 employees (about one-third of staff) and abandoned much of its election security assistance to states ahead of the midterms.
  • Experts say there is no evidence voting machine vulnerabilities have ever been exploited to alter a real US election; most machines are not internet-connected and use auditable paper ballots.
  Sources 📎 Coverage: propublica.org · 👁 via @metacurity@infosec.exchange

• Risky Bulletin: PwnEscape KVM escape, BeyondTrust zero-day abuse, and supply chain incidents top week's news
  Catalin Cimpanu's weekend digest highlights the PwnEscape KVM escape vulnerability, ARMORY CASTLE abusing a BeyondTrust zero-day, and multiple breaches and supply chain incidents.

  • Applies to readers tracking the week's major infosec stories covered in Risky Business's Risky Bulletin newsletter
  • Security stories include ARMORY CASTLE abusing a BeyondTrust zero-day, a SiteGuard WAF bug exploited in the wild, and the PwnEscape vulnerability allowing KVM escape
  • Supply chain incidents were reported at AOMEI and ConnectWise, alongside an Apache Airflow host key verification failure and TP-Link Tapo camera takeover bugs
  • Breach and incident news includes the Cali DoE breach affecting 7 million California students, Burger King Japan affecting 11.2 million customers, Gamdom hacked for $4.2m, and Pirate Chain for $10m
  • Other items: an arrested Qilin member linked to the Synnovis hack, TAG-217 targeting South Korean banks, new malware QuartzLine, HypeAgent and Romulus, and Proofpoint acquiring Varonis
  Sources 📎 Coverage: news.risky.biz · 👁 via @campuscodi@mastodon.social (+3)