<![CDATA[đŸ”´ Critical: Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App]]>Attackers have been exploiting a vulnerability in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers and backdoor them. At least three administrators reported the issue on GitHub, with the earliest logged attack dating to September 10.

A web shell is a small file that lets an attacker execute arbitrary commands through web requests, running with the privileges of the web server account. Once dropped, it gives the intruder a persistent foothold on the host.

Key points so far:

  • Affected component: the Collabora Online - Built-in CODE Server app, which is optional rather than part of a default Nextcloud install.
  • Impact: remote attackers can deploy web shells, leading to command execution on the server.
  • Reporting: the first reports came from three administrators on GitHub; the initial observed attack occurred on September 10.
  • No specific CVE ID or patch identifier has been provided in the source reporting at this time.

Administrators running the Built-in CODE Server app should review their Nextcloud instances for unexpected files, check web server logs for suspicious requests, and consider disabling the app if it is not required until more details emerge. Because the reports are still developing, watch the official Nextcloud and Collabora channels for updates rather than relying on unofficial advisories.

Source: The Hacker News

Are you running the Collabora Built-in CODE Server app in your environment, and if so, have you checked it for signs of compromise?

]]>https://xploitlk.com/topic/726/critical-hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collabora-s-built-in-code-appRSS for NodeTue, 27 Oct 2026 08:16:23 GMTSun, 18 Oct 2026 04:30:20 GMT60