[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnIl5AOJJwqX0QSsia6w4YJzth9w_c3elh9ujPyMnFRs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"576eb234-7900-4851-ba57-9ae3fbf1c5f9","unpatched-collabora-rce-flaw-lets-attackers-backdoor-nextcloud-servers","4ec2ce18-e73f-4bcc-b2a9-d3880cd2eed5","Unpatched Collabora RCE Flaw Lets Attackers Backdoor Nextcloud Servers","Attackers are actively exploiting CVE-2026-110447, a critical unauthenticated remote code execution vulnerability in the Collabora Online (CODE) app bundled with Nextcloud, to plant webshells and exfiltrate sensitive data. The flaw requires no authentication, meaning any internet-exposed instance running a vulnerable version is at risk without any attacker credential requirements. This incident highlights the danger of delaying patches for internet-facing collaboration platforms, where exploitation timelines from disclosure to active attack can be extremely short. The presence of webshells also indicates attackers intend persistent, long-term access — making rapid detection and response equally as critical as patching.","**Immediate actions:**\n- Apply the vendor-released patch or upgrade the Collabora Online\u002FCODE server app to a non-vulnerable version immediately.\n- Temporarily restrict public internet access to Nextcloud\u002FCollabora instances until patching is confirmed complete.\n- Scan all Nextcloud servers for indicators of compromise, including unexpected webshells or new files in web-accessible directories.\n\n**Long-term improvements:**\n- Implement an automated vulnerability scanning program that continuously monitors internet-facing applications for newly disclosed CVEs.\n- Maintain a current, accurate software inventory (SBOM) of all third-party apps and integrations deployed on collaboration platforms.\n- Establish and rehearse an emergency patching procedure with defined SLAs (e.g., critical CVEs patched within 24–48 hours).\n\n**Detection measures:**\n- Deploy file integrity monitoring (FIM) on web server directories to alert on unauthorized file creation or modification.\n- Centralize and actively monitor web server and application logs for anomalous POST requests, shell command patterns, or unexpected outbound connections.\n- Configure network segmentation so that collaboration servers cannot initiate arbitrary outbound connections to unknown external hosts.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","GDPR Article 32: Security of Processing (obligation to implement appropriate technical measures)","ITIL: Change Management — Emergency Change procedures for critical vulnerability remediation",{},"published","2026-10-15T22:20:38.414254+00:00","2026-10-15T22:20:38.386+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers\u002F","hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers-d0b526","Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"824dbb17-4d42-4236-bc55-7e7d721ec869","2026-10-16","morning","ThreatNoir Morning Brief — October 16","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-16\u002Fthreatnoir-morning-brief-2026-10-16.mp3",[59,62,65],{"slug":36,"name":60,"problem":61},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":48,"name":63,"problem":64},"Automated patch management","Known holes get closed in days, not months.",{"slug":66,"name":67,"problem":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]