Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Attackers are exploiting CVE-2026-110447 in Nextcloud's built-in Collabora app to plant webshells and hunt credentials.
Threat actors are exploiting CVE-2026-110447, an unauthenticated OS command injection in Nextcloud's optional richdocumentscode app (Collabora Online built-in CODE server) before version 26.4.303. Exploitation hits proxy.php only when the bundled server is stopped; standalone Collabora, Docker, package installs, and Nextcloud All-in-One are unaffected. Reports dating to September 10 describe PHP webshells used to search for password databases, password-manager files, and cryptocurrency wallets. The fix was released September 11, but the advisory and CVE were published October 14; claimed ransomware use was not independently confirmed.