Web Shell
Security incidents tagged Web Shell. Newest first.
1 Web Shell incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 42
- Longest quiet run: 21 days (Sep 12–Oct 2)
Show 1 older incident1 older incident
September 2026 1
- Patched
Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447)
An unauthenticated OS command injection in proxy.php of Collabora Online - Built-in CODE Server (richdocumentscode), an optional Nextcloud app, lets attackers run commands on the Nextcloud server whenever the app's local CODE document server isn't running, for example during a restart, an upgrade or after a crash. It was exploited in the wild in September and October 2026 to plant web shells, with the first attack reported on GitHub on Sep 10. Collabora fixed it in richdocumentscode 26.4.303 on Sep 11 and published CVE-2026-110447 (CVSS 4.0 9.2) on Oct 14; it is a different bug from the 2025 proxy RCE CVE-2025-66208. Turning the app off is not enough: update it or remove it. Standalone Collabora Online servers, Docker or distro packages, hosted Collabora, and Nextcloud Office (richdocuments) without the built-in app are not affected. Admins who ran a vulnerable version should also hunt for unexpected PHP files.
Collabora Online - Built-in CODE Server (richdocumentscode) for NextcloudSince Sep 10, 2026
