Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.
https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/
BleepingComputer
npub1j7…v7hg2
2026-10-15 20:25:21 UTC
Author Public Key
npub1j7dz37jrwqhehe8ydzpk5kcjpnzzv53h7s54lj62nv5w9fcar34suv7hg2Seen on
wss://relay.ditto.pubPublished at
2026-10-15 20:25:21 UTCEvent JSON
{
"id": "5831215aff03b47ec18d4e7076a493797b1495ff0441e513876caef9191c1e7b",
"pubkey": "979a28fa43702f9be4e468836a5b120cc4265237f4295fcb4a9b28e2a71d1c6b",
"created_at": 1792095921,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/users/BleepingComputer/statuses/117446798291252405",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/",
"sig": "099fe1aa8d5731bcc287f30843779f29056e41df511c5f121d5d9df7b673e6743bd441368f50c9da6852aa8ba13e0308692435ed07ef11f2d90f2141c8984b06"
}