For our clients who are utilising the Updraft plugin, we recommend following updates from the plugin provider to manage the 3rd-party plugin.

https://teamupdraft.com/blog/security-incident-october-2026/#updraftcentral-cloud-users-please-do-this-today

We are taking action on a security incident affecting WordPress websites that use the UpdraftPlus plugin.

TeamUpdraft, the company behind UpdraftPlus, has confirmed that its systems were breached on 17-18 October and that UpdraftCentral connection keys were exposed. Attackers are using these keys to install malicious plugins on connected websites. A small number of websites on our network were compromised this way, and we have contained them.

So far, we have:

added a firewall rule on our hosting servers that blocks the requests used in this attack
removed UpdraftCentral connection keys from the most at-risk websites, and we are reviewing the rest
As a further precaution, we intend to temporarily disable the UpdraftPlus plugin on hosted websites. While it is disabled, UpdraftPlus backups and UpdraftCentral management will not run. We will post an update before this change is made.

If you notice unfamiliar plugins or administrator accounts on your website, please raise a support ticket with our team.

Thank you for your understanding and patience.