Unknown threat actors exploited a flaw in Collabora Online - Built-in CODE Server, an optional Nextcloud application, to plant web shells on targeted servers. The first logged attack occurred on September 10, 2026. Three administrators reported the issue on GitHub. The vulnerability allows remote command execution via web shells planted through the CODE Server, with commands executed under the web server account's rights. No patch has been explicitly mentioned; administrators have reported the issue on GitHub, suggesting a future update or configuration change may be required.

Which products are affected?

Collabora Online - Built-in CODE Server

What should defenders do?

Administrators are advised to monitor GitHub reports for updates from Collabora or Nextcloud. Until a patch is released, users should consider disabling the CODE Server app if not required and reviewing server logs for suspicious activity indicative of web shell deployment.

highCyber Attacks

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App

Web shells planted via vulnerability in optional Nextcloud application; administrators report issue on GitHub

Cyber.TechVoidPublished about 1 hour agoUpdated less than a minute ago1 min read

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App

Key Takeaways

A flaw in Collabora Online - Built-in CODE Server is being exploited to plant web shells on Nextcloud servers.
The first logged attack occurred on September 10, 2026.
Three administrators have reported the issue on GitHub.
No explicit patch has been mentioned; remediation likely requires a CODE Server update or configuration changes.

Related Security News

highCyber Attacks

U.S. Disrupts North Korean IT Worker Fraud Scheme, Seizes 187 Computers from 40 Laptop Farms

The U.S. Department of Justice announced the disruption of a North Korea-linked fraud operation involving fraudulent remote IT workers. Authorities seized approximately 187 computers from over 40 "laptop farms" and charged 14 individuals — a mix of U.S. citizens and Chinese nationals — with wire fraud conspiracy and related offenses. The scheme allegedly affected more than 70 U.S. companies, using stolen résumés and fake identities to secure remote employment and generate revenue for the Democratic People's Republic of Korea.

The Hacker Newsabout 1 hour ago1 min read

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App

Key Takeaways

Related Security News

U.S. Disrupts North Korean IT Worker Fraud Scheme, Seizes 187 Computers from 40 Laptop Farms

Quick answers

Security Details

Sources

Weekly Cybersecurity Recap: Zero-Days, Rogue Certificates, and Helpdesk Scams

Ahold Delhaize Takes Systems Offline Following Cybersecurity Incident

SonicWall SMA1000 Appliances Exploited in the Wild Following CVE-2026-102255 Disclosure

AI-Augmented Campaign Cyberxero Steals Over 628,000 Ukrainian Records

Three Research Teams Remotely Compromise Fully Patched Google Pixel 10 at Pwn2Own Ireland