Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.
Excerpt from the primary source: BleepingComputer
Who is affected
Security professionals
Why it matters
Source reporting says attackers are already exploiting this, so exposed affected systems are at immediate risk.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running the affected products, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Is the cybersecurity world really facing a "Bugmageddon?" Thor breaks down the latest CVE and KEV trends in the latest Threat Source newsletter.
Vulnerability Management Isn't About the Score — It's About How It Applies to You
Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVE-2026-21589) is being actively exploited, CISA warns
CISA added CVE-2026-21589 (Atlassian Multiple Products) to its Known Exploited Vulnerabilities catalog on October 15, 2026, which means there is reliable evidence of exploitation in the wild. Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or…
CISA lists this as exploited in the wild. Unpatched Confluence & Jira and Multiple Products systems are exposed to active attacks now.
Treat this as an emergency.
Eclipse Foundation Eclipse Milo
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of Eclipse Foundation Eclipse Milo are affected: Eclipse Milo >=0.6.0|<=1.1.4 (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007) Eclipse Milo >=1.0.0|<=1.1.4…