Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account.

Published 16-Oct-2026 19:00 UTC · First seen 14-Oct-2026 20:31 UTC

Sources

• The Hacker News · 14-Oct-2026