Hancocks IT

Daily briefing 25 October 2026

Each morning: website security and anything else that might affect a small business in southern Sweden, in plain words.

UpdraftPlus: stolen keys used to plant backdoors on WordPress sites

TeamUpdraft, the company behind the popular backup plugin UpdraftPlus, says its own website was broken into on 17–18 October. Attackers then used stolen UpdraftCentral connection keys to install hidden plugins and create extra user accounts on WordPress sites linked to the service. Your site may be linked even if you never used UpdraftCentral, because linking the plugin to a TeamUpdraft account ticks that option by default. If you use UpdraftPlus, check that it is on version 1.26.13 (free) or 2.26.13 (Premium) or newer, then look for plugins and users you don't recognise, such as a plugin called 'Site Health Cache'. The update stops new break-ins but does not remove anything already installed, so restore from a backup made before 17 October if you find anything.

Sources: teamupdraft.com · relevantaudience.com

Want to talk it through?

For advice on any of this, ring Svarslinjen (+46766860150) or see svarslinjen.se.

A normal call on your phone bill, plus Svarslinjen's minutes: the first three are free.

If your website or email needs looking at, tell Hancocks IT what's up or start with the free PHP checker.

From Andy

All articles

How calls are charged

The number is answered by Svarslinjen, an AI phone line Andy also runs. Say "Hancocks IT" as soon as it answers, or read out your ticket number, and you're put through.

Your phone company charges a normal call, as for any call to a Swedish mobile number.

Once you're put through to Hancocks IT, there's nothing more to pay for the call. The few seconds before that count as Svarslinjen minutes, and a new number gets three free.

Questions that aren't about a job are answered by Svarslinjen on its own minutes: the first three are free, and after that you buy minutes at svarslinjen.se.