“An estimated 10% of sites using UpdraftPlus have an UpdraftCentral or Migrator key.”
A backup vendor kept the keys to its customers’ sites in its own database. Then the database got breached. The attackers didn’t need an exploit. They signed commands with valid keys. TeamUpdraft says it “closed the access route” and won’t say what it was.