[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQXJBA2zPIociA_-hUH0MEqOD11NhSMgdyJeQinEyj78":3},{"article":4,"iocs":49,"watch_terms":57,"solutions":58,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"0ae0c831-9e79-472d-a5f3-a297db67f020","Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App","hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collabora-s-built-in-272064","Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw","Attackers exploited a critical vulnerability in Collabora's built-in CODE app for Nextcloud, allowing them to plant web shells on affected servers. The flaw, identified as CVE-2026-110447, enabled unauthenticated command execution when the app's local document server was not running. Collabora has released a patch, version 26.4.303, and advises users to update or remove the affected app.","Hackers exploit Collabora CODE app flaw in Nextcloud to backdoor servers.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fhackers-backdoor-nextcloud-servers.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhkZLcjmZtzt6NpWa8x4Wz7EdcOQEW6xYv6DA_mBnwy1ctZZeRAyeSYLES-H_mkr1QOBv72WNuGKwKQ-NN179Rw8BRTcYO38sYwxcbDkg1ISW_qWrCRJ9JfUXh3102OmwrF0HQq6dbSc58VXACXoi_EoI8ysPuSlzB_nBcHuFl9r3QakOsGG9GUm6UVOU8\u002Fs1600\u002Fnextcloud.jpg","2026-10-14T17:38:31+00:00","2026-10-14T20:00:11.866281+00:00",8,[17,20,22,25],{"name":18,"type":19},"Nextcloud","product",{"name":21,"type":19},"Collabora Online - Built-in CODE Server",{"name":23,"type":24},"Collabora","vendor",{"name":26,"type":27},"web shell","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2026-110447","Critical vulnerability in Collabora's CODE app for Nextcloud.",{"type":51,"value":55,"context":56},"CVE-2025-66208","Previous command-injection flaw in the same script.",[23,18,21],{"controls":59,"vendors":143},[60,89,114],{"slug":61,"name":62,"problem":63,"products":64},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,98,106],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":90,"product_name":95,"url":96,"description":97},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":160},"unpatched-collabora-code-app-lets-attackers-backdoor-nextcloud-servers","Unpatched Collabora CODE App Lets Attackers Backdoor Nextcloud Servers","Attackers exploited CVE-2026-110447, a critical unauthenticated remote code execution vulnerability in Collabora's CODE app bundled with Nextcloud, to plant persistent web shells on unpatched servers. The flaw was triggerable specifically when the local document server was not actively running, meaning even lightly-used or misconfigured deployments were at risk. This incident highlights the danger of third-party or bundled applications expanding an organization's attack surface without receiving the same patching scrutiny as the core platform. Because no authentication was required to exploit the flaw, any internet-facing Nextcloud instance with the CODE app installed was potentially exposed to full server compromise. Timely patching and active inventory management of all integrated components are essential to preventing this class of supply-chain-adjacent attack.",[149,150,151,152,153,154,155,156,157,158,159],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 CM-8: System Component Inventory","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST CSF ID.AM-2: Software platforms and applications are inventoried","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","GDPR Article 32: Security of processing (applicable if personal data stored in Nextcloud)","ITIL Change Management: Emergency change procedures for critical vulnerability remediation",{"NIST SP 800-53 SI-2: Flaw Remediation":161,"NIST SP 800-53 CM-8: System Component Inventory":162,"CIS Control 12: Network Infrastructure Management":163,"CIS Control 7: Continuous Vulnerability Management":164,"CIS Control 2: Inventory and Control of Software Assets":165,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":166,"NIST CSF ID.AM-2: Software platforms and applications are inventoried":167,"GDPR Article 32: Security of processing (applicable if personal data stored in Nextcloud)":168,"ITIL Change Management: Emergency change procedures for critical vulnerability remediation":169,"NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":170},"Requires timely remediation of the Collabora flaw.","Component inventory tracks bundled apps like Collabora CODE, which can be overlooked.","Limiting exposure of Nextcloud servers reduces the attack surface.","Rapid patching of Collabora CODE closes CVE-2026-110447 before web shells are planted.","A software inventory shows which Nextcloud servers include the Collabora CODE app.","Integrity monitoring can detect web shells planted on Nextcloud servers.","Inventorying software includes bundled components, such as Collabora in Nextcloud.","Requires appropriate security for personal data stored in Nextcloud.","Emergency change procedures help deploy critical fixes quickly.","Requires mitigating new vulnerabilities, such as disabling CODE until patched."]