bleeping-computer · Crawled Oct 15, 2026
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
1 IoCs 1 CVEs
Read original article ↗
AI Summary
Threat actors are actively exploiting a critical remote command execution vulnerability, CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. The flaw exists in versions prior to 26.4.303 and allows unauthenticated OS command injection via the proxy.php endpoint when the built-in server is stopped. Attackers are deploying PHP webshells to search for password databases, password manager artifacts, and cryptocurrency wallets. Exploitation began in mid-September, over four weeks before the CVE was published on October 14, highlighting a dangerous gap between patch availability and formal disclosure.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 1 extracted
| Type | Value | Detail |
|---|---|---|
| Filename | proxy.php | Details → |
MITRE ATT&CK TTPs 7 techniques
T1005 Data from Local System · Collection T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1105 Ingress Tool Transfer · Command And Control T1190 Exploit Public-Facing Application · Initial Access T1203 Exploitation for Client Execution · Execution T1566 Phishing · Initial Access