Hackers exploit Collabora CODE flaw to deploy Nextcloud backdoors
Hackers are actively exploiting a critical remote command execution vulnerability in the Collabora Online Built-in CODE Server app for Nextcloud to plant web shells.
FTMQ Security, written by our newsroom0 views
Hackers are actively exploiting a critical command execution vulnerability in the Collabora Online Built-in CODE Server app for Nextcloud, BleepingComputer reported. The security flaw allows unauthorized attackers to backdoor vulnerable servers. Pasquale Pillitteri also reported that the flaw in the application is being leveraged to plant PHP web shells. [1][2]
The vulnerability is tracked as CVE-2026-110447 and affects the richdocumentscode app versions prior to 26.4.303, according to BleepingComputer. The underlying flaw resides in the Nextcloud app's startup mechanism for the bundled Collabora server. BleepingComputer noted that multiple administrator reports show attacks started in mid-September, about a month before official advisories and the CVE assignment. [1]
Nextcloud is a self-hosted workspace platform for team collaboration that integrates office tools such as Collabora Online. A web shell is a web browser interface that allows remote management of a web server, making it a common vector for remote control after an initial breach. [4][5]
In short
- Hackers are actively exploiting CVE-2026-110447 in the Collabora Online Built-in CODE Server app.
- The vulnerability affects richdocumentscode versions before 26.4.303.
- Attacks reportedly began in mid-September before official advisories were released.
- Exploitation allows attackers to plant malicious PHP web shells on Nextcloud instances.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Hackers exploit Collabora RCE flaw to backdoor Nextcloud serversBleepingComputer, 4h ago (the report this story comes from)
- [2]Nextcloud flaw in Collabora CODE app exploited to plant PHP web shellsPasquale Pillitteri, 18h ago
Background
Our newsroom writes these reports with the help of software, from the 5 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Microsoft releases updates for more than 1400 security vulnerabilitiesTop Stories, 2d ago
- Microsoft patches actively exploited Windows Shell zero day vulnerabilityBugs and Patches, 1h ago
- Hackers exploit Ninja Forms and WooCommerce plugin flaws in WordPressTop Stories, 9d ago
- KGB RAT trojan bypasses Windows Defender to spy on usersCybercrime and Scams, 1h ago
More in Top Stories
- Cisco Patches Zero Day Flaw in Secure Email Gateway1d ago
- Microsoft and Health ISAC seize domains powering massive Chinese phishing network1d ago
- Palo Alto Networks patches PAN-OS zero-day exploited in firewall attacks1d ago
- Critical Ghostscript vulnerability allows remote code execution through malicious PDF files2d ago
- Meta suffers GitHub breach exposing corporate code and employee data2d ago
- Former OpenAI engineer arrested after covert listening device found in conference room2d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.