We care about
your security.
Nethemba is a leading Slovak IT security firm specialized in web security, penetration testing, and RFID security audits. Since 2007, we’ve been securing businesses with cutting-edge research and expertise, trusted by companies worldwide.

We care about
your security.
Nethemba is a leading Slovak IT security firm specialized in web security, penetration testing, and RFID security audits. Since 2007, we’ve been securing businesses with cutting-edge research and expertise, trusted by companies worldwide.

Our Services

Application Security

Network and System Security
BLOG
Critical security problem in UpdraftCentral: an attacker holding the service’s keys planted a backdoor on our websites
On the night of 19 October 2026 an attacker abused UpdraftCentral, the remote management service built into UpdraftPlus, a backup plugin with more than 4 million installations, and planted a backdoor on two of our three websites. Our sites were fully up to date and the fault was not on our side: the attacker signed the commands with valid keys that the UpdraftCentral Cloud service generates and keeps. We publish an analysis of the backdoor, indicators of compromise and a...
Read MoreWe built an ORSR aggregator and priced out harvesting the whole register (the birth number, signature and health insurer of every Slovak company owner)
In one evening we built an AI-assisted ORSR aggregator: one click gives the birth number, signature, home address and health insurer of any Slovak company director. And we priced out harvesting the entire register: the cost of a used laptop.
Read MoreThe State as the Biggest Threat to Your Privacy
A senseless Slovak statute published the birth numbers, addresses and certified signatures of company directors — and it is not a bug, it is written into Section 100(3). We are convinced the greatest threat to citizens privacy today is the state itself.
Read MoreOn the night of 19 October an attacker sent validly signed UpdraftCentral commands to three of our WordPress sites and installed a backdoor plugin on two of them. The sites were fully up to date, on UpdraftPlus 2.26.11, patched against the June vulnerability CVE-2026-10795. The attacker did not break into our servers. The commands were signed with the private dashboard keys that UpdraftCentral Cloud generates and keeps, keys that never existed on our side.
The backdoor waits for a secret link, then creates an account that looks like an ordinary Editor but can change every setting and install plugins, and logs the attacker straight in, bypassing the login form and two-factor authentication. A bug in its code made it crash our sites instead of working. A fixed version would take a few characters.
UpdraftPlus has more than 4 million active installations and every copy contains the UpdraftCentral client. Any site connected to UpdraftCentral is exposed, including the latest version. There is no fix yet.
What to do now:
• delete the key in UpdraftPlus > Advanced Tools > UpdraftCentral
• check the site with our free read-only WP-CLI script
• do not reconnect until TeamUpdraft explains how the keys leaked
We reported it to TeamUpdraft the same day. Because the attack is active and publishing gives the attacker nothing new, we are publishing the analysis, indicators of compromise and the checker right away:
https://nethemba.com/updraftcentral-backdoor-analysis/
#WordPress #infosec #UpdraftPlus #cybersecurity
SQL injection (involving a WAF bypass) allows us to write a shell in the webserver root. We then abuse a custom python application to gain more rights as another user. Finally systemctl with SUID rights grants us root access after a period of losing my mind.
https://www.youtube.com/watch?v=BoChqSyOi48
Max Hillebrand · Slovenský preklad tretieho vydania
https://towardsliberty.com/pop/sk/




