Hackers exploit a Collabora flaw in Nextcloud to plant backdoors
Event Brief generated 30 s read
Written by an AI. It was merged from the source on this page and has not been reviewed by a person.
The short version
- CVE-2026-110447 is a critical command execution flaw in the richdocumentscode app.
- Attackers are actively exploiting it to backdoor Nextcloud servers.
- The items do not give a patched version number.
What happened
BleepingComputer reports that threat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447. It affects the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. The attackers are using it to backdoor Nextcloud servers.
Why it might matter
Nextcloud servers often hold shared files and credentials. Administrators who run this app should check whether it is installed and whether their server has been modified.
What we don’t know yet
The summary does not give the fixed version, the number of compromised servers, or the attacker. Check the vendor advisory before acting.
