First: a full backup, off the server
A record, not a restore point. Download the files and database to your computer, or send them to external storage, before touching anything. If the site is hacked, this backup is too: it won’t help you roll back, but it will help you compare, date the intrusion, and show your host or a provider what was found. Don’t delete anything before you’ve finished inspecting.
1. Update directly by logging in
Log in to each site’s admin panel directly, not through UpdraftCentral. That’s the first rule from TeamUpdraft, the publisher. Then, after backing up, update in this order.
WordPress. The latest version is 7.1.3, released October 6, 2026, with seven security fixes. If your site is still on an older branch, take at least its latest version—for example, 7.0.7, 6.9.10, or 6.8.11—which also received the same fixes. A site that hasn’t applied the September 22 patch (7.1.2, 7.0.6, 6.9.9, or 6.8.10, depending on the branch) remains exposed to the core vulnerability exploited since that day.
UpdraftPlus. Update to 1.26.13, or 2.26.13 for the Premium version, released on the evening of October 19. Avoid 1.26.12, published the same day: due to a bug, it didn’t revoke the keys.
Other extensions and the theme. Apply all available updates. If you use Ninja Forms, check you’re at least on 3.15.4; Bricksforge, 3.1.8.10; Elementor Pro, 4.2.2.
PHP. On October 21, PHP patched two critical vulnerabilities that WordPress updates don’t address. Ask your host for a fixed version (8.5.12, 8.4.27, 8.3.36, or 8.2.35), or check yours with my dedicated tool.
Update and close the door securely. This doesn’t remove anything already entered: that’s the purpose of the six checks that follow.
2. Accounts that can install extensions
Don’t just look at administrators. The fake October 2026 extensions create an Editor account and grant it two permissions: manage settings and install extensions. In the list of accounts, it appears as a simple Editor. The names identified by Patchstack, Nethemba, and IT-Connect follow the same pattern: two words and two or three numbers (data-ops43, media-staff96, content-ops71), with « Site Tools » as the displayed name and an address at @example.org or @example.com.
What you need to do. Open Accounts, All Accounts, and review each Editor and each Administrator: who created it, when, and with which address. Delete any account that no one recognizes, after changing your own password. Warning: some variants log in with the first existing administrator instead of creating an account, and the hidden account remains in place even after the extension is removed.
3. Extensions, including the « Must-Use » tab
In the admin panel. Extensions, Installed Extensions: look for an extension you didn’t install. The descriptions found resemble maintenance tasks (« Small maintenance toolkit: keeps option storage tidy », « Maintenance helper »), with names like « Site Health Cache » or folders with random suffixes (load-stack-35c, site-health-364f, type-stack-285). Patchstack identified 99 different names. Also check the « Must-Use » tab (Must-Use in English), which is almost always overlooked.
On the server. Some variants hide from the list. Open your hosting file manager or an FTP client, and check three folders: wp-content/plugins, wp-content/mu-plugins, and wp-content/upgrade. The latter keeps a copy of installed packages, even if the installation failed. A recent folder you don’t recognize is suspicious.
Don’t delete it from the admin panel. Nethemba, who discovered the attack, advises disabling the extension and then moving its folder outside the site: deleting it from the admin panel triggers its uninstall script, which erases its traces. And if a page displays an « Undefined constant » error, don’t fix the code: the first variant was broken, and repairing it would reopen the backdoor.
4. The UpdraftCentral key
Where to find it. Settings, UpdraftPlus, Advanced Tools tab, UpdraftCentral. If a key appears there, the site can receive remote commands. Remove all keys from the list of existing keys, not just the site in your UpdraftCentral dashboard: removing the site from the dashboard doesn’t delete the key.
You never activated it? Check anyway. The box that adds the site to UpdraftCentral is checked by default when linking UpdraftPlus to a TeamUpdraft account, and these keys never expire. With command-line access, the command `wp option get updraft_central_localkeys` returns something if a key exists. The full procedure, including backups, is in my UpdraftPlus guide.
5. The .php files in wp-content/uploads
This folder should only contain images and documents. Sucuri reminds us in its guides: a .php, .js, or .ico file in uploads is suspicious. Fall campaigns left them in specific places: wp-content/uploads/elementor/forms for Elementor Pro, wp-content/uploads/bricksforge/tmp for Bricksforge. In your hosting file manager, search for « .php » in the uploads folder; via command line, `find wp-content/uploads -name ".php"` lists them.
6. Google Search Console
Three screens to check. Security & Manual Actions, Security Issues: Google flags a hacked site here. Settings, Users & Permissions: an unknown owner is a classic sign of Japanese keyword hacking, which also adds its own sitemaps. Pages: a sudden spike in indexed pages. And in Google, a search `site:yourdomain.fr` reveals pages you didn’t write.
7. Your hosting access logs
What to look for. Your host provides server logs. For UpdraftCentral, Nethemba spotted POST requests to the homepage with the user agent « WordPress/6.4; class-udrpc.php ». For secret link logins, requests to the homepage with a 32-character parameter: a 302 response likely means a successful login, a 500 response indicates a broken variant still installed. UpdraftPlus logs also track received commands, like « Command received: plugin.upload_plugin ». IPs aren’t reliable filters: Patchstack saw attackers switch infrastructure in under a day.
If you find anything
Change everything—twice. All admin passwords, FTP, database, hosting, and TeamUpdraft account passwords (type them manually, never click a link in an email). Then update the secret keys in wp-config.php, which closes all open sessions. Repeat after cleanup and reset two-factor authentication.
Restore if in doubt. A backup from before October 17, then the UpdraftCentral key deleted again—a copy from that date still contains it. The steps are in my restoration guide.
Think about personal data. If the site holds customer accounts, orders, or forms, report the breach to the CNIL within 72 hours if it risks harming individuals.
Don’t reconnect UpdraftCentral right away. Patchstack advises waiting for the editor to explain the origin of the leak.
Frequently Asked Questions
My site is up to date: am I affected?
For UpdraftCentral, yes, if the site had an active key: the IT-Connect site, in UpdraftPlus Premium 2.26.11, received the command on October 19 at 7:17 AM. For Ninja Forms or Bricksforge, a patched version closes the door but does not remove an already created account.
How long do these checks take?
About an hour on a healthy site, with access to the admin panel and hosting. If cleaning or restoring is needed, count more time.
Do I need to be a developer?
No for the first six checks: the WordPress admin, the hosting file manager, and Search Console are sufficient. Logs and the command line require more familiarity.
Would a security extension have been enough?
Wordfence or Sucuri help detect modified files and block part of the attacks, but a command signed with a real UpdraftCentral key is seen as a legitimate command.
Would you prefer me to handle it?
I perform these checks from the inside, clean if necessary, change keys and passwords, update everything, and write down what has been done: free diagnosis within 24 hours, quote before any intervention. The process and update prices are on the remote intervention page.
Sources: October 2026 security incident, TeamUpdraft, compromised UpdraftCentral keys and backdoors, Patchstack, backdoor analysis, Nethemba, the IT-Connect site was hit on October 19th, XSS campaign by Ninja Forms, Patchstack, Bricksforge vulnerability exploited, Patchstack, Heartbleed-like flaw CVE-2026-87902, Patchstack, WordPress 7.1.3, WordPress.org, PHP vulnerabilities from October 21st, Sucuri, Japanese keyword spam, Sucuri.
