Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers have exploited a flaw in the Collabora Online built-in CODE app for Nextcloud to plant web shells on servers, The Hacker News reports. The unauthenticated command-execution flaw (CVE-2026-110447) can be triggered when the app’s local document server is stopped, such as during a restart or upgrade; Collabora fixed it in September and warns that disabling the app is not enough — it must be updated or removed.