Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers, The Hacker News reported on October 14, 2026.
Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account.
Sources and references
Original report
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00PVLIBS
Cite this
APA
Interestana AI Editorial. (2026, October 14). Attackers Backdoor Nextcloud Servers Through Collabora CODE App Flaw. Interestana. https://interestana.com/articles/hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collaboras-built-in-code-app-00pvlibs
MLA
“Attackers Backdoor Nextcloud Servers Through Collabora CODE App Flaw.” Interestana, 14 Oct. 2026, interestana.com/articles/hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collaboras-built-in-code-app-00pvlibs.
Chicago
Interestana AI Editorial. “Attackers Backdoor Nextcloud Servers Through Collabora CODE App Flaw.” Interestana, October 14, 2026. https://interestana.com/articles/hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collaboras-built-in-code-app-00pvlibs.
BibTeX
@misc{interestana_00pvlibs,
author = {{Interestana AI Editorial}},
title = {{Attackers Backdoor Nextcloud Servers Through Collabora CODE App Flaw}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collaboras-built-in-code-app-00pvlibs},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html}
}Credit the source
Original reporting: The Hacker News, “Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App”, https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe