{"id":10822,"date":"2026-10-19T16:06:45","date_gmt":"2026-10-19T16:06:45","guid":{"rendered":"https:\/\/affinite.io\/cs\/updraftplus-bezpecnostni-incident\/"},"modified":"2026-10-19T16:28:00","modified_gmt":"2026-10-19T16:28:00","slug":"updraftplus-bezpecnostni-incident","status":"publish","type":"post","link":"https:\/\/affinite.io\/cs\/updraftplus-bezpecnostni-incident\/","title":{"rendered":"Bezpe\u010dnostn\u00ed incident u UpdraftPlus: koho se t\u00fdk\u00e1 a co ud\u011blat hned"},"content":{"rendered":"\n
\n

Aktualizov\u00e1no 19. 10. 2026.<\/strong> \u010cl\u00e1nek vych\u00e1z\u00ed z ofici\u00e1ln\u00edho vyj\u00e1d\u0159en\u00ed TeamUpdraft z 19. \u0159\u00edjna. Vy\u0161et\u0159ov\u00e1n\u00ed st\u00e1le prob\u00edh\u00e1 a v\u00fdrobce svoje stanovisko pr\u016fb\u011b\u017en\u011b dopl\u0148uje \u2014 u kl\u00ed\u010dov\u00fdch krok\u016f proto v\u017edy zkontrolujte i p\u016fvodn\u00ed str\u00e1nku incidentu<\/a>.<\/p>\n<\/blockquote>\n\n\n\n

O v\u00edkendu 17.\u201318. \u0159\u00edjna se n\u011bkdo neopr\u00e1vn\u011bn\u011b dostal na web teamupdraft.com<\/strong> \u2014 tedy k v\u00fdrobci UpdraftPlus, nejroz\u0161\u00ed\u0159en\u011bj\u0161\u00edho z\u00e1lohovac\u00edho pluginu pro WordPress. Podle vyj\u00e1d\u0159en\u00ed firmy byla pravd\u011bpodobn\u011b zp\u0159\u00edstupn\u011bna z\u00e1kaznick\u00e1 datab\u00e1ze.<\/p>\n\n\n\n

Hned na \u00favod to podstatn\u00e9, proto\u017ee se to v obecn\u00e9 panice ztr\u00e1c\u00ed: samotn\u00fd plugin UpdraftPlus napaden\u00fd nebyl a va\u0161e z\u00e1lohy u Google Drive, Dropboxu nebo S3 jsou v po\u0159\u00e1dku.<\/strong> Pro v\u011bt\u0161inu u\u017eivatel\u016f jde o \u201ezm\u011b\u0148te si heslo“. Existuje ale jedna skupina, kter\u00e1 mus\u00ed jednat okam\u017eit\u011b \u2014 a je to v\u00e1\u017en\u00e9.<\/p>\n\n\n\n

Koho se to t\u00fdk\u00e1<\/h2>\n\n\n\n
Co pou\u017e\u00edv\u00e1te<\/th>Jak moc v\u00e1s to p\u00e1l\u00ed<\/th>Co ud\u011blat<\/th><\/tr><\/thead>
UpdraftCentral v cloudu<\/strong><\/td>Vysok\u00e1 priorita<\/strong><\/td>Zabezpe\u010dit ka\u017ed\u00fd web zvl\u00e1\u0161\u0165, je\u0161t\u011b dnes<\/td><\/tr>
UpdraftVault<\/td>St\u0159edn\u00ed<\/td>Znovu p\u0159ipojit weby, jinak se z\u00e1lohy neukl\u00e1daj\u00ed<\/td><\/tr>
UpdraftClone<\/td>St\u0159edn\u00ed<\/td>Rozeslat nov\u00e9 kl\u00ed\u010de, star\u00e9 nefunguj\u00ed<\/td><\/tr>
\u00da\u010det na teamupdraft.com<\/td>N\u00edzk\u00e1<\/td>Zm\u011bnit heslo, resetovat 2FA<\/td><\/tr>
UpdraftPlus zdarma, bez \u00fa\u010dtu<\/td>\u017d\u00e1dn\u00e1<\/td>Nic<\/td><\/tr>
UpdraftCentral na vlastn\u00edm serveru<\/td>\u017d\u00e1dn\u00e1<\/td>Nic<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Co p\u0159esn\u011b uniklo<\/h2>\n\n\n\n

Podle TeamUpdraft datab\u00e1ze obsahovala:<\/p>\n\n\n\n

    \n
  • jm\u00e9na, e-maily, faktura\u010dn\u00ed adresy a historii objedn\u00e1vek<\/li>\n\n\n
  • hesla \u2014 pouze v zahashovan\u00e9 podob\u011b<\/strong>, nikdy ne v \u010diteln\u00e9m textu<\/li>\n\n\n
  • nastaven\u00ed dvouf\u00e1zov\u00e9ho ov\u011b\u0159en\u00ed<\/li>\n\n\n
  • p\u0159ipojovac\u00ed kl\u00ed\u010de pro UpdraftCentral, UpdraftVault a UpdraftClone<\/strong><\/li>\n\n<\/ul>\n\n\n\n

    Platebn\u00ed \u00fadaje firma neukl\u00e1d\u00e1, platby jdou p\u0159es Stripe a PayPal.<\/p>\n\n\n\n

    Ten tu\u010dn\u011b vyzna\u010den\u00fd \u0159\u00e1dek je j\u00e1dro cel\u00e9ho probl\u00e9mu. P\u0159ipojovac\u00ed kl\u00ed\u010d UpdraftCentralu um\u00ed va\u0161emu webu pos\u00edlat p\u0159\u00edkazy<\/strong>. Prakticky to znamen\u00e1 tot\u00e9\u017e co administr\u00e1torsk\u00fd p\u0159\u00edstup \u2014 jen se k n\u011bmu nep\u0159ihla\u0161uje p\u0159es wp-login.php<\/code>, ale p\u0159es API. Kdo ten kl\u00ed\u010d m\u00e1, m\u016f\u017ee na va\u0161em webu instalovat pluginy, zakl\u00e1dat u\u017eivatele a m\u011bnit obsah.<\/p>\n\n\n\n

    Pou\u017e\u00edv\u00e1te UpdraftCentral v cloudu? Ud\u011blejte tohle dnes<\/h2>\n\n\n\n

    TeamUpdraft chyst\u00e1 nouzovou aktualizaci UpdraftPlus, kter\u00e1 v\u0161echna star\u00e1 spojen\u00ed odpoj\u00ed automaticky. Ne\u010dekejte na ni.<\/strong> Dokud nevyjde a dokud se nenainstaluje, je star\u00fd kl\u00ed\u010d platn\u00fd.<\/p>\n\n\n\n

    Pro ka\u017ed\u00fd web zvl\u00e1\u0161\u0165:<\/p>\n\n\n\n

      \n
    1. P\u0159ihlaste se do WordPressu dan\u00e9ho webu p\u0159\u00edmo<\/strong>, ne p\u0159es UpdraftCentral.<\/li>\n\n\n
    2. Jd\u011bte do Nastaven\u00ed \u2192 UpdraftPlus \u2192 Advanced Tools \u2192 UpdraftCentral<\/strong> a p\u0159ipojovac\u00ed kl\u00ed\u010d sma\u017ete.<\/li>\n\n\n
    3. V U\u017eivatel\u00e9<\/strong> zkontrolujte, jestli nep\u0159ibyl administr\u00e1tor, kter\u00e9ho nezn\u00e1te. Takov\u00fd \u00fa\u010det odstra\u0148te.<\/li>\n\n\n
    4. V Pluginy<\/strong> projd\u011bte seznam v\u010detn\u011b z\u00e1lo\u017eky Must-Use<\/strong>, pokud ji vid\u00edte. Cokoli nezn\u00e1m\u00e9ho odstra\u0148te.<\/li>\n\n\n
    5. Zm\u011b\u0148te hesla v\u0161em administr\u00e1tor\u016fm<\/strong> webu.<\/li>\n\n\n
    6. Pokud najdete cokoli podez\u0159el\u00e9ho, zva\u017ete obnovu ze z\u00e1lohy po\u0159\u00edzen\u00e9 p\u0159ed 17. \u0159\u00edjnem<\/strong>.<\/li>\n\n\n
    7. Teprve potom web znovu p\u0159ipojte k UpdraftCentralu.<\/li>\n\n<\/ol>\n\n\n\n

      Z\u00e1lo\u017eka Must-Use v kroku 4 je d\u016fle\u017eit\u00e1 a \u010dasto se p\u0159ehl\u00ed\u017e\u00ed. Mu-pluginy se na\u010d\u00edtaj\u00ed automaticky, nejdou vypnout z administrace a v b\u011b\u017en\u00e9m seznamu plugin\u016f nejsou vid\u011bt \u2014 jsou proto obl\u00edben\u00fdm m\u00edstem, kam se schov\u00e1v\u00e1 zadn\u00ed vr\u00e1tka.<\/p>\n\n\n\n

      Nouzov\u00e1 aktualizace odpoj\u00ed jen spojen\u00ed vytvo\u0159en\u00e1 p\u0159ed 18. \u0159\u00edjnem 22:00 britsk\u00e9ho \u010dasu<\/strong>. Kdy\u017e web podle n\u00e1vodu v\u00fd\u0161e znovu p\u0159ipoj\u00edte, aktualizace ho u\u017e neodpoj\u00ed.<\/p>\n\n\n\n

      UpdraftVault a UpdraftClone<\/h2>\n\n\n\n

      UpdraftVault<\/strong> \u2014 v\u0161echny weby byly odpojeny, tak\u017ee se z\u00e1lohy do Vaultu neukl\u00e1daj\u00ed, dokud je znovu nep\u0159ipoj\u00edte. V Nastaven\u00ed \u2192 UpdraftPlus \u2192 Nastaven\u00ed<\/strong> klikn\u011bte u vzd\u00e1len\u00e9ho \u00falo\u017ei\u0161t\u011b na UpdraftVault, pod \u201eAlready got space?“ na Connect, zadejte e-mail a nov\u00e9<\/strong> heslo a ulo\u017ete. Pak pus\u0165te ru\u010dn\u00ed z\u00e1lohu, a\u0165 m\u00e1te jistotu.<\/p>\n\n\n\n

      Tohle je tich\u00e1 past: z\u00e1lohy neb\u011b\u017e\u00ed a nic na to neupozorn\u00ed. \u010c\u00edm d\u0159\u00edv to vy\u0159e\u0161\u00edte, t\u00edm krat\u0161\u00ed d\u00edru v z\u00e1loh\u00e1ch budete m\u00edt.<\/p>\n\n\n\n

      UpdraftClone<\/strong> \u2014 v\u0161echny klientsk\u00e9 kl\u00ed\u010de byly vym\u011bn\u011bny. Pokud jste kl\u00ed\u010de sd\u00edleli se sv\u00fdmi klienty, nov\u00e9 najdete v My Account \u2192 UpdraftClone \u2192 UpdraftClone Key Management<\/strong> a mus\u00edte je rozeslat. Klonov\u00e1n\u00ed se star\u00fdm kl\u00ed\u010dem skon\u010d\u00ed chybou.<\/p>\n\n\n\n

      Pozor na phishing<\/h2>\n\n\n\n

      \u00dato\u010dn\u00edci maj\u00ed jm\u00e9na, e-maily a historii objedn\u00e1vek<\/strong>. To je ide\u00e1ln\u00ed materi\u00e1l pro c\u00edlen\u00fd podvod \u2014 e-mail, kter\u00fd zn\u00e1 va\u0161e jm\u00e9no, va\u0161i licenci i datum n\u00e1kupu, p\u016fsob\u00ed mnohem d\u016fv\u011bryhodn\u011bji ne\u017e b\u011b\u017en\u00fd spam.<\/p>\n\n\n\n

      \u010cekejte zpr\u00e1vy ve stylu \u201eva\u0161e licence UpdraftPlus vy\u017eaduje ov\u011b\u0159en\u00ed“ nebo \u201ekv\u016fli incidentu si resetujte p\u0159\u00edstup zde“. TeamUpdraft nikdy nebude cht\u00edt va\u0161e heslo ani kl\u00ed\u010de.<\/strong> Kdy\u017e si jdete m\u011bnit heslo, napi\u0161te si teamupdraft.com<\/code> do prohl\u00ed\u017ee\u010de ru\u010dn\u011b \u2014 neklikejte na odkaz v e-mailu, ani kdy\u017e vypad\u00e1 v po\u0159\u00e1dku.<\/p>\n\n\n\n

      Co firma u\u017e ud\u011blala<\/h2>\n\n\n\n

      Pro \u00faplnost: TeamUpdraft uzav\u0159el cestu, kterou se \u00fato\u010dn\u00edk dostal dovnit\u0159, odhl\u00e1sil v\u0161echny \u00fa\u010dty, vym\u011bnil p\u0159ihla\u0161ovac\u00ed \u00fadaje k UpdraftVaultu, nahradil v\u0161echny kl\u00ed\u010de UpdraftClone, zrotoval kl\u00ed\u010de k platebn\u00edm bran\u00e1m, nasadil dodate\u010dn\u00fd monitoring a incident nahl\u00e1sil \u00fa\u0159ad\u016fm v\u010detn\u011b britsk\u00e9ho ICO.<\/p>\n\n\n\n

      Komunikace prob\u011bhla slu\u0161n\u011b \u2014 konkr\u00e9tn\u00ed seznam dot\u010den\u00fdch dat, konkr\u00e9tn\u00ed kroky pro u\u017eivatele, p\u0159iznan\u00e1 nejistota. To je u incident\u016f bohu\u017eel sp\u00ed\u0161 v\u00fdjimka.<\/p>\n\n\n\n

      Co si z toho odn\u00e9st<\/h2>\n\n\n\n

      Mimo samotn\u00e9 odstran\u011bn\u00ed n\u00e1sledk\u016f m\u00e1 tenhle p\u0159\u00edpad jedno obecn\u00e9 pou\u010den\u00ed, kter\u00e9 plat\u00ed i pro ty, kdo UpdraftPlus v\u016fbec nepou\u017e\u00edvaj\u00ed.<\/p>\n\n\n\n

      N\u00e1stroje pro centr\u00e1ln\u00ed spr\u00e1vu web\u016f koncentruj\u00ed riziko.<\/strong> UpdraftCentral, ManageWP, MainWP a podobn\u00e9 panely jsou u\u017eite\u010dn\u00e9 \u2014 bez nich se deset web\u016f spravuje t\u011b\u017eko. Jejich cenou ale je, \u017ee n\u011bkde mimo v\u00e1\u0161 web le\u017e\u00ed kl\u00ed\u010d, kter\u00fd va\u0161emu webu um\u00ed porou\u010det. Kdy\u017e se n\u011bkdo dostane do datab\u00e1ze provozovatele toho panelu, dostane se t\u00edm i ke v\u0161em web\u016fm p\u0159ipojen\u00fdm pod n\u00edm.<\/p>\n\n\n\n

      Nen\u00ed to argument proti centr\u00e1ln\u00ed spr\u00e1v\u011b. Je to argument pro to v\u011bd\u011bt, kdo v\u0161echno m\u00e1 k va\u0161im web\u016fm p\u0159\u00edstup na \u00farovni p\u0159\u00edkaz\u016f<\/strong> \u2014 a um\u011bt ten seznam vyjmenovat d\u0159\u00edv, ne\u017e se n\u011bco stane. V\u011bt\u0161ina provozovatel\u016f to nev\u00ed. Pat\u0159\u00ed tam spr\u00e1vcovsk\u00e9 panely, z\u00e1lohovac\u00ed slu\u017eby s obousm\u011brn\u00fdm p\u0159\u00edstupem, deploy n\u00e1stroje, monitoring se z\u00e1pisem, agentury a b\u00fdval\u00ed dodavatel\u00e9.<\/p>\n\n\n\n

      Druh\u00e9 pou\u010den\u00ed je k z\u00e1loh\u00e1m. Rada \u201eobnovte ze z\u00e1lohy p\u0159ed 17. \u0159\u00edjnem“ funguje jen tehdy, kdy\u017e takovou z\u00e1lohu m\u00e1te, v\u00edte kde je a um\u00edte ji nasadit. Z\u00e1loha, kterou jste nikdy nezkou\u0161eli obnovit, nen\u00ed z\u00e1loha \u2014 je to nad\u011bje.<\/p>\n\n\n\n

      Pot\u0159ebujete s t\u00edm pomoct?<\/h2>\n\n\n\n

      Pokud spravujete v\u00edc web\u016f a nechcete proch\u00e1zet ka\u017ed\u00fd ru\u010dn\u011b, nebo si nejste jist\u00ed, jestli na n\u011bkter\u00e9m z nich \u00fato\u010dn\u00edk nezanechal stopu, ozv\u011bte se n\u00e1m. Um\u00edme proj\u00edt u\u017eivatele, pluginy v\u010detn\u011b mu-plugin\u016f, napl\u00e1novan\u00e9 \u00falohy i soubory a porovnat je proti \u010dist\u00e9mu stavu.<\/p>\n\n\n\n

      A pokud nev\u00edte, kdo v\u0161echno m\u00e1 k va\u0161im web\u016fm p\u0159\u00edstup, je to samo o sob\u011b dobr\u00fd d\u016fvod k revizi \u2014 nez\u00e1visle na tom, jestli se v\u00e1s tenhle konkr\u00e9tn\u00ed incident t\u00fdk\u00e1.<\/p>\n","protected":false},"excerpt":{"rendered":"

      O v\u00edkendu 17.\u201318. \u0159\u00edjna se n\u011bkdo neopr\u00e1vn\u011bn\u011b dostal k v\u00fdrobci UpdraftPlus. Unikl\u00e9 p\u0159ipojovac\u00ed kl\u00ed\u010de um\u00ed va\u0161emu webu pos\u00edlat p\u0159\u00edkazy. Komu sta\u010d\u00ed zm\u011bnit heslo a kdo mus\u00ed jednat hned.<\/p>\n","protected":false},"author":0,"featured_media":10823,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_uag_custom_page_level_css":"","footnotes":""},"categories":[6],"tags":[],"class_list":["post-10822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bezpecnost-wordpressu"],"acf":[],"uagb_featured_image_src":{"full":["https:\/\/affinite.io\/cs\/wp-content\/uploads\/sites\/2\/2026\/10\/updraftplus-incident-4x3-1.png",1200,900,false],"thumbnail":["https:\/\/affinite.io\/cs\/wp-content\/uploads\/sites\/2\/2026\/10\/updraftplus-incident-4x3-1-150x150.png",150,150,true],"medium":["https:\/\/affinite.io\/cs\/wp-content\/uploads\/sites\/2\/2026\/10\/updraftplus-incident-4x3-1-300x225.png",300,225,true],"medium_large":["https:\/\/affinite.io\/cs\/wp-content\/uploads\/sites\/2\/2026\/10\/updraftplus-incident-4x3-1-768x576.png",768,576,true],"large":["https:\/\/affinite.io\/cs\/wp-content\/uploads\/sites\/2\/2026\/10\/updraftplus-incident-4x3-1-1024x768.png",1024,768,true],"1536x1536":["https:\/\/affinite.io\/cs\/wp-content\/uploads\/sites\/2\/2026\/10\/updraftplus-incident-4x3-1.png",1200,900,false],"2048x2048":["https:\/\/affinite.io\/cs\/wp-content\/uploads\/sites\/2\/2026\/10\/updraftplus-incident-4x3-1.png",1200,900,false]},"uagb_author_info":{"display_name":"","author_link":"https:\/\/affinite.io\/cs\/author\/"},"uagb_comment_info":0,"uagb_excerpt":"O v\u00edkendu 17.\u201318. \u0159\u00edjna se n\u011bkdo neopr\u00e1vn\u011bn\u011b dostal k v\u00fdrobci UpdraftPlus. Unikl\u00e9 p\u0159ipojovac\u00ed kl\u00ed\u010de um\u00ed va\u0161emu webu pos\u00edlat p\u0159\u00edkazy. Komu sta\u010d\u00ed zm\u011bnit heslo a kdo mus\u00ed jednat hned.","_links":{"self":[{"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/posts\/10822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/comments?post=10822"}],"version-history":[{"count":1,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/posts\/10822\/revisions"}],"predecessor-version":[{"id":10824,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/posts\/10822\/revisions\/10824"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/media\/10823"}],"wp:attachment":[{"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/media?parent=10822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/categories?post=10822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/tags?post=10822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}