[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvVGQE5ALGKcv5OnwpBhNwi3q87twjCcg4E-1FaVDlNw":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"4ec2ce18-e73f-4bcc-b2a9-d3880cd2eed5","Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers","hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers-d0b526","Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]","Threat actors are actively exploiting a critical command execution vulnerability (CVE-2026-110447) in the Collabora Online app for Nextcloud, allowing them to backdoor servers. Attacks began in mid-September, with attackers planting webshells to search for sensitive data. The vulnerability impacts specific versions of the built-in CODE server app and requires the server to be stopped for exploitation, with no authentication needed.","Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers via CVE-2026-110447.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F15\u002Fnextcloud.jpg","2026-10-15T20:25:04+00:00","2026-10-15T22:00:08.859976+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"Collabora Online - Built-in CODE Server","product",{"name":21,"type":19},"Nextcloud",{"name":23,"type":24},"Collabora","vendor",{"name":26,"type":27},"PHP webshells","technology",{"name":29,"type":24},"Second Security","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-110447","Critical command execution flaw in Collabora Online app for Nextcloud",[23,29,18],{"controls":60,"vendors":145},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,129,137],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":125,"product_name":126,"url":127,"description":128},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":163},"unpatched-collabora-rce-flaw-lets-attackers-backdoor-nextcloud-servers","Unpatched Collabora RCE Flaw Lets Attackers Backdoor Nextcloud Servers","Attackers are actively exploiting CVE-2026-110447, a critical unauthenticated remote code execution vulnerability in the Collabora Online (CODE) app bundled with Nextcloud, to plant webshells and exfiltrate sensitive data. The flaw requires no authentication, meaning any internet-exposed instance running a vulnerable version is at risk without any attacker credential requirements. This incident highlights the danger of delaying patches for internet-facing collaboration platforms, where exploitation timelines from disclosure to active attack can be extremely short. The presence of webshells also indicates attackers intend persistent, long-term access — making rapid detection and response equally as critical as patching.",[151,152,153,154,155,156,157,158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","GDPR Article 32: Security of Processing (obligation to implement appropriate technical measures)","ITIL: Change Management — Emergency Change procedures for critical vulnerability remediation",{}]