If you ever connected UpdraftCentral to a WordPress site, someone may have used a stolen key to push a backdoor to it starting October 18. If you downloaded Rank Math PRO 3.0.123 on October 15 or 16, the plugin itself carried one. In both cases, updating afterward does not remove what was already installed.
Neither attack needed a guessed password or an unpatched site. Both came through software the site already trusted. So did two more incidents the same week, outside WordPress.
This is written for businesses running WordPress with plugins someone else maintains. If your team builds its own software, there is a short section near the end for you.
Start here
- UpdraftPlus. If you ever connected UpdraftCentral or created a Migrator key, update to 1.26.13 (free) or 2.26.13 (paid) or later, delete the keys, and look for plugins and administrator accounts you do not recognize.
- Rank Math PRO. If your site ran 3.0.123 downloaded between 4:02 p.m. on October 15 and 3:12 a.m. on October 16, Eastern time, follow Rank Math's cleanup steps. Updating alone is not enough.
- PHP version. Your site should run PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later. In WordPress, Tools, then Site Health, then Info shows it.
- Who holds a key. List every person, plugin and service that can install code on your site or log in as an administrator. Remove anything you cannot name a reason for.
- Your backups. Restore one to a test copy. A backup you have never restored is a guess.
What happened
UpdraftPlus keys, October 18. TeamUpdraft, which makes the UpdraftPlus backup plugin, said it found unauthorized access to its website over the weekend of October 17 and 18. The attacker likely reached the customer database holding the keys for UpdraftCentral, the dashboard that lets one person manage many WordPress sites. Starting at 15:32 UTC on October 18, according to the security firm Patchstack, those keys were used to push at least 99 different backdoor plugins to connected sites, disguised as maintenance tools, with names like "Site Health Cache." The sites accepted the commands because they were signed with valid dashboard keys. About 10% of UpdraftPlus sites hold one of those keys, which puts roughly 400,000 sites at risk. Revoking the key stops new commands. It does not remove anything already installed.
Rank Math PRO, disclosed October 19. Copies of Rank Math PRO 3.0.123 downloaded from Rank Math during an 11-hour window on October 15 and 16 carried malware. It recreates hidden backdoors when the site is visited and exposes database credentials, API keys and other secrets the web server can reach. Rank Math's own warning is the part to remember: deactivating or updating the plugin after a compromise will not remove the threat. The free version, active on more than 4 million sites, was not affected.
PHP2Shell, October 21. The PHP project shipped emergency fixes for two critical flaws in PHP itself, the language WordPress runs on. They can allow code to run on a server without logging in. Cloudflare saw tens of thousands of exploit attempts within 45 minutes of the announcement and millions by the next morning. The UK government took 32 digital services offline as a precaution. As of October 23, researchers had not confirmed a successful break-in, and Sansec found the public exploits do not work against a default PHP setup. That is good news with a short shelf life. PHP 8.1 and older get no new releases at all, only patches for people who build PHP by hand, and PHP 8.2 stops receiving fixes on December 31, 2026.
The same pattern outside WordPress
On October 21, attackers used stolen GitHub tokens from three engineers to run the real release process for LiteLLM, a widely used library that connects applications to AI models, and published a version carrying a credential stealer for about two hours. The same day, the cloud platform Railway said attackers may have obtained the decrypted contents of some customers' stored passwords and API keys, and told all users to rotate their keys. Earlier that week, the AI coding tool OpenCode reported that attackers took API keys from more than 1% of its customers.
If you build software: replace every key on any machine that installed LiteLLM 1.107.0, and rotate any secrets stored on Railway.
The cost of a break-in is falling
On October 19, Reuters reported that a criminal had used autonomous AI agents, built from an open-source security testing tool, against more than 1,200 sites. The agents reached the websites of more than 100 companies. About 1 in 10 attempts succeeded, taking just under 23 hours on average, at an estimated $50 in AI costs per successful break-in.
When a break-in costs $50, nobody needs a reason to pick your site. It only has to be on the list.
What this means for a business website
Your site's risk is no longer just the site. It is the site plus everything that holds a key to it or ships code into it: the backup service, every plugin vendor whose updates install automatically, the host, and whoever manages it for you.
Convenience and exposure are the same feature. A dashboard that lets one person update, back up and restore many sites is how sites stay patched. On October 18 it was also how backdoors were pushed in bulk.
So ask whoever manages your site three questions. We think every agency should be able to answer them, us included:
- Who and what holds administrator access to my site, and when was that list last reviewed?
- If you manage my site through a central dashboard, what protects that dashboard, and what happens to my site if it is compromised?
- How fast do you apply a security fix, and how do you decide?
Our answers, for the record. On October 23 we checked every site we manage for all three issues above: UpdraftCentral keys, the affected Rank Math PRO build and the PHP version. Every one came back clean. And how fast a fix goes on depends on how severe the issue is. Something being exploited right now does not wait for a maintenance window.
Not sure where your site stands?
Send us your URL. We only need the URL. We will not ask for a login or a key. We will check what can be seen from the outside, including your WordPress plugins and the PHP version your site exposes, and reply with a short written list: which items above apply to you, which do not, and what to fix first. If a key has already been misused, updating will not remove what it installed, so sooner beats later. If the fix is more than a quick job, we will tell you what it involves, and you can hand the list to your own developer.
For the longer argument on why a security plugin alone does not protect a WordPress site, read Your WordPress site is being targeted. A security plugin is not a security architecture.