Attackers backdoor Nextcloud via Collabora CODE flaw

Attackers exploited CVE-2026-110447 in Nextcloud’s optional Collabora CODE app to plant PHP webshells.

Threat actors exploited CVE-2026-110447, an unauthenticated OS command injection (CWE-78, CVSS v4 9.2) in proxy.php of Nextcloud’s optional richdocumentscode app, Collabora Online’s built-in CODE Server, in every version before 26.4.303. The flaw works only while that bundled server is stopped, such as during a restart, upgrade, or crash, and can run commands as the web-server user. Standalone Collabora Online, Docker and package installs, Nextcloud All-in-One, and Nextcloud Office without the built-in app are unaffected. The Hacker News and BleepingComputer report logged attacks from September 10, 2026, in which attackers planted PHP webshells—named shx*.php in The Hacker News—and searched for password databases, password-manager files, and cryptocurrency wallets, with no confirmed root access, file exfiltration, or independently verified ransomware use. GBHackers, citing the advisory, says no public exploitation was reported, which conflicts with those reports and with Cyber Security News, which says the GitHub advisory reports exploitation in September and October 2026 and that users reported web shells. Collabora shipped the fix on September 11 and published the CVE and advisory on October 14; administrators should update to 26.4.303 or later or remove the app, then hunt for shells, because disabling it is insufficient, Nextcloud 29 and older cannot install the fix, and the earlier CVE-2025-66208 patch does not stop this issue.

• CVE-2026-110447 is an unauthenticated OS command injection (CWE-78, CVSS v4 9.2) in proxy.php of Nextcloud’s optional richdocumentscode app (Collabora Online Built-in CODE Server), in every version before 26.4.303.
• The flaw works only while the bundled CODE server is stopped, such as during a restart, upgrade, or crash, and can run commands as the web-server user.
• Standalone Collabora Online, Docker and package installs, Nextcloud All-in-One, and Nextcloud Office without the built-in app are unaffected.
• The Hacker News and BleepingComputer report attacks from September 10, 2026: PHP webshells (named shx*.php in The Hacker News) used to search password databases, password-manager files, and cryptocurrency wallets; no confirmed root access,…
• GBHackers, citing the advisory, says no public exploitation was reported, which conflicts with those reports and with Cyber Security News, which says the GitHub advisory reports exploitation in September and October 2026 and that Nextcloud…
• The fix shipped September 11; the CVE and advisory were published October 14. Update to 26.4.303 or later or remove the app—disabling it is insufficient; Nextcloud 29 and older cannot install the fix. CVE-2025-66208 does not stop this…