Attackers are exploiting CVE-2026-110447 to plant PHP web shells on Nextcloud servers, BleepingComputer and The Hacker News report. The flaw sits in the Collabora Online Built-in CODE Server app (richdocumentscode), not in Collabora Online generally. CVSS v4 is 9.2.
The bug is an OS command injection in the way the app starts its bundled Collabora server. It affects versions before 26.4.303. An unauthenticated request to the app's proxy.php endpoint can run a command, but only while the local document server is not running, for example during a restart, an upgrade or after a crash. Standalone Collabora servers and Docker, RPM/DEB and Nextcloud All-in-One deployments are not affected, according to Collabora.
Reports say exploitation began around September 10. Attackers dropped PHP web shells and used them to search for password databases, password manager artifacts and cryptocurrency wallets. Some users claim ransomware operators are involved. BleepingComputer could not confirm that.
Why it matters: Nextcloud often holds an organisation's documents and credentials, and the trigger condition is easy to create or wait for. A server that restarts on a schedule has a recurring exposure window.
Mitigation. Collabora's advisory is explicit: disabling the app is not enough. Upgrade it to 26.4.303 or later, or remove it. The fixed versions require Nextcloud 30 or later. One report says version 26.4.402 stopped the CODE server starting on some installations and some administrators rolled back to 26.4.303, so test before rolling out.
Detection. Search the apps/richdocumentscode directory for unexpected PHP files, including names matching shx*.php. That file naming comes from a single report. Review web logs for requests to proxy.php?status containing %2e%2e, $( or ${IFS}. If you find a shell, treat the host as compromised and rotate any credentials stored on it.
