After the backup tool's signature key is stolen, backdoors can also be installed through official channels, how can the site self-check?
When a backup plug-in vendor's customer database leaks remote management keys, the sequence of self-inspection of the site is more important than the tool: first count which sites are connected to centralized management, then rotate the keys, then check for writing traces and scheduled tasks, and finally determine if the backup can be used.The trouble with this kind of event does not lie in the vulnerability, but in the credentials—the attacker has obtained a legitimate key, taking the normal management channel, and the site side cannot see the typical traces of 'being attacked'.As per the public announcement, from October 17 to 18, 2026, the customer database of the developer of the backup plugin UpdraftPlus was accessed without authorization, which contained the keys for the centralized management tool UpdraftCentral;Starting from October 18th, the backdoor was written to the site using a valid key, the developer released version 1.26.13 on October 19th to revoke the keys issued before that moment, and the affected parties estimate that about 400,000 sites were affected.
What level of credentials were leaked
The design goal of centralized management tools is to 'control multiple sites with one console', the operations that the held keys can perform are site-level write operations: install plugins, modify files, create accounts. Once these keys are leaked, the risk does not target a specific site, but covers all sites connected.
| Self-check item | Where to look first | Abnormal signal | Disposal order |
|---|---|---|---|
| Access list | List of sites bound in the console | Unrecognized sites or duplicate entries | Unbind and rotate immediately |
| Key validity period | Issued time earlier than the revoked version | Still using the old key | Re-sign after upgrading to the revoked version |
| Writing痕迹 | Plugin and theme directory, upload directory | Foreign files, recently modified templates | Record timestamp and then clean up |
| Account and permissions | Administrator list, password reset records | Temporary Administrator, Anomalous Login | Disable and change password |
| Schedule Task | Scheduled scripts, task queue | Unknown task or external link request | Disable first and then investigate |
| Backup integrity | Backup file generation time | Backup generated after event window | Restore using the backup before the event |
Why did the official channel become the delivery path
The automatic update mechanism trusts the signature and source, not the content of the file itself. When the key's trustworthiness is compromised, the judgment 'downloaded from regular channels' becomes invalid: the update link is accepted as is, and malicious code enters with legitimate packages. This is the definition of a supply chain event - the defense line is built on the channels, and the attack occurs within the trust relationship of the channels.
For individual webmasters, the most expensive cost is the time difference: there is only one or two days between the key leak and the version release, and whether the site is upgraded in time determines whether it is exposed in the window.
For sites connected to centralized management, check three places first.
The first step is to count, list all the sites that have been managed by this console, including old sites that are no longer maintained. Old sites are more likely to be ignored and are more likely to contain old versions.
The second step is to rotate. Any credentials that can issue site-level write operations should be treated as leaked: revoke first, then reissue, do not clean up while the old credentials are still valid, otherwise they will be written again.
The third step is to check for writing traces. The focus is on three places: unknown files in the plugin and theme directories, modified templates and entry files, and temporary administrator accounts and scheduled tasks in the database.
After confirming that it has been changed: restore or reinstall
First, rotate the credentials, then decide the recovery method, the order cannot be reversed. Restoring from a backup generated after the event window is equivalent to inviting the backdoor back as well.
- Can determine the modified time point: use the backup with integrity verified before the time point, and change the password and rotate immediately after recovery.
- Cannot determine: rebuild in a clean environment, move the content as data, and do not move the executable files.
- After recovery: rebuild the update channel, clarify who has the authority to trigger station-level operations.
The system backup and recovery can restore the entire data if it covers data and static files; it can also recover the entire data without manually piecing together files and libraries; this is also a capability worth confirming when selecting a content management system, AnQiCMS provides backup capabilities in this respect.
What aspect of the attack surface is lost with independent deployment?
The risk does not lie in 'multiple plugins', but in the existence of a credential entry that can perform batch operations on the site. Converging all-site operations by domain and not exposing them by default is another approach: AnQiCMS's MCP interface sets the exposure range by intent domain, with backup, upgrade, and multi-site operations in high-risk domains closed by default and requiring explicit enablement to reduce the space that can be utilized for orchestration.
The robot traffic on the form side is intercepted with reCAPTCHA, and the rotation of management credentials is a separate line; do not expect one mechanism to solve both types of problems.
There are two fixed things to do after the upgrade.
Any version upgrade that fixes a vulnerability should include two things in the process: rotating the site signature key and changing the administrator password. When AnQiCMS fixed the injection issue with the list sorting parameters in v3.6.6 and the high-risk issue of the login credentials for site switching being forgeable, the upgrade advice given was just these two steps—the patch only closed the vulnerability path, and the credentials that have already been obtained will not become invalid due to applying the patch.
Common questions
Is the site that has not been connected to centralized management secure?Not on the list of affected this time, but the same risk applies to any third-party service that holds write permissions for the site, and it is still necessary to count the authorized objects.
Is changing the password enough?Not enough. The leakage of keys and signature credentials is independent of account passwords, and both sides need to be rotated.
How can you determine if the backup has been contaminated?Compare the backup generation time with the event window, and treat backups later than the start of the window as suspicious. Prioritize the earlier one that can be verified for integrity.
What is the lowest-cost defense for a personal website owner?Keep the update channel open, upgrade the revocation mechanism as soon as it is released, and make a backup that can be rolled back as a whole.