CRITICALVulnerability
Global

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

·Source: The Hacker News

Updated:

Executive Summary

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw

Analysis

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Source Attribution

Originally published by The Hacker News on Oct 14, 2026.

Related Threats

MEDIUMVulnerability

NatWest enlists Nvidia to help its AI spending tool understand regional accents

NatWest has harnessed AI speech recognition technology from Nvidia to help its new audio-visual spending insights tool understand customers' accents and pronunciations.

Finextra
MEDIUMVulnerability

Pathology Lab Confirms Hack, But Disputes Data Theft Claims

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/pathology-lab-confirms-hack-but-disputes-data-theft-claims-image_small-1-a-33106.jpg" align=right hspace=4><b>South African Ampath Laboratories Doubts Hackers Stole 80 Million Patient Records</b><br>A major South African pathology laboratory confirmed on Wednesday that it's responding to a recent cyber incident, but the company di

Bank Info Security
MEDIUMVulnerability

Researchers Find Yandex Strikes Didn’t Silence Russian Bots

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/researchers-find-yandex-strikes-didnt-silence-russian-bots-image_small-8-a-33108.jpg" align=right hspace=4><b>Viral Cloudflare Chart Tracked Yandex’s Search Crawler, Researchers Say</b><br>A viral claim that Ukrainian drone strikes on Yandex knocked Russian propaganda bots offline rests on a chart of web crawler traffic - but new

Bank Info Security