Attackers Backdoor Nextcloud Servers Through Collabora CODE Flaw: What Canadian Self-Hosters Must Do
What Happened
Attackers are backdooring Nextcloud servers through CVE-2026-110447, an unauthenticated command injection in the proxy.php script of the Collabora Online Built-in CODE Server app, The Hacker News reports. Every version before 26.4.303 is affected. Standalone Collabora Online servers are not.
The flaw is reachable only while the app’s local document server is not running, such as during a restart, upgrade, or crash. The first logged attack came September 10. Attackers planted PHP web shells and used webhook.site for callbacks. One administrator found searches for credential stores and crypto wallets. Three administrators reported the issue on GitHub. Version 26.4.303 shipped September 11 and needs Nextcloud 30 or later, but its release notes did not clearly flag a security fix. Disabling the app does not help. Collabora says to upgrade or remove it.
Why This Matters for Canadian Organizations
Many Canadian universities, municipalities, health providers, and small firms run Nextcloud to keep data on Canadian soil. This flaw turns the choice into exposure if the CODE app is installed and unpatched. Nextcloud 29 and older are end-of-life and cannot install the fix, which leaves those servers with no direct path to safety. A web shell on a file server holding client records creates a breach assessment under PIPEDA, and Quebec organizations answer to Law 25.
The weak release notes make matters worse. Teams reading changelogs for security labels would have skipped this update.
What to Do
Check whether the richdocumentscode app is installed and confirm the version is at least 26.4.303. If the app is present and old, treat the server as suspect. Search the web root for unexpected PHP files and review logs for requests to proxy.php. Block callbacks to webhook.site and check for connections from 139.28.18.122 and 89.38.98.50. Note reports of startup trouble with 26.4.402, and some administrators reverted to 26.4.303. Plan upgrades for any Nextcloud 29 or older instance. Rotate credentials stored on affected servers. More coverage sits in our TechTalk archive.
