Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
AI Summary
Attackers exploited a critical command injection vulnerability in the Collabora Online - Built-in CODE Server app (package: richdocumentscode) for Nextcloud, tracked as CVE-2026-110447, to deploy PHP web shells on unpatched servers. The flaw allowed unauthenticated remote code execution via a maliciously crafted request path during server startup or restart, enabling attackers to execute commands as the web server user. Multiple administrators reported compromises starting September 10, 2026, with evidence of post-exploitation activity including credential and cryptocurrency wallet searches. The vulnerability was actively exploited in the wild before a public advisory or CVE was issued on October 14, 2026.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 13 extracted
| Type | Value | Detail |
|---|---|---|
| Filename | shrf4645.php | Details → |
| Filename | shxa35d0.php | Details → |
| Filename | shx5cf91.php | Details → |
| Filename | shxd33ce.php | Details → |
| Filename | shxf4645.php | Details → |
| Filename | shx13a86.php | Details → |
| Filename | shx56367.php | Details → |
| SHA-256 | 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562 | Details → |
| Domain | webhook[.]site | Details → |
| IP | 139[.]28[.]18[.]122 | Details → |
| IP | 89[.]38[.]98[.]50 | Details → |
| Package | richdocumentscode | Details → |
| Filename | proxy.php | Details → |