Hacking DeskVictoria Police warn of AI fake-doctor gift card scam How-to DeskHow to spot a fake shopping site before Black Friday AmplifiedAnberlin — Never Take Friendship Personal Hacking DeskRansomware negotiator charged, ShinyHunters link reported How-to DeskHow to set up a digital legacy for Apple and Google AmplifiedEmery — The Question How-to DeskHow to run Chrome's Safety Check and tighten privacy How-to DeskHow to move to a new phone and wipe the old one AmplifiedDemon Hunter — Summer of Darkness How-to DeskHow to lock down your WhatsApp privacy settings How-to DeskHow to lock down your Apple Account AmplifiedNorma Jean — Bless the Martyr and Kiss the Child How-to DeskHow to check every protection in Windows Security How-to DeskHow to check your Mac's security settings How-to DeskHow to check if your email was in a data breach How-to DeskHow to cancel subscriptions on iPhone and Android How-to DeskHow to ask a company what personal data it holds on you How-to DeskHow to use a travel eSIM on your iPhone overseas How-to DeskHow to lock down your home Wi-Fi router How-to DeskHow to screen scam calls on iPhone and Pixel

Hacking DeskVictoria Police warn of AI fake-doctor gift card scam How-to DeskHow to spot a fake shopping site before Black Friday AmplifiedAnberlin — Never Take Friendship Personal Hacking DeskRansomware negotiator charged, ShinyHunters link reported How-to DeskHow to set up a digital legacy for Apple and Google AmplifiedEmery — The Question How-to DeskHow to run Chrome's Safety Check and tighten privacy How-to DeskHow to move to a new phone and wipe the old one AmplifiedDemon Hunter — Summer of Darkness How-to DeskHow to lock down your WhatsApp privacy settings How-to DeskHow to lock down your Apple Account AmplifiedNorma Jean — Bless the Martyr and Kiss the Child How-to DeskHow to check every protection in Windows Security How-to DeskHow to check your Mac's security settings How-to DeskHow to check if your email was in a data breach How-to DeskHow to cancel subscriptions on iPhone and Android How-to DeskHow to ask a company what personal data it holds on you How-to DeskHow to use a travel eSIM on your iPhone overseas How-to DeskHow to lock down your home Wi-Fi router How-to DeskHow to screen scam calls on iPhone and Pixel

Saturday 17 October 2026

Collabora Nextcloud app flaw CVE-2026-110447 exploited

Attackers exploited CVE-2026-110447 in Nextcloud's Built-in CODE app from 10 September. Version 26.4.303 fixes it. Here's what to check.

Quin Halberg Saturday 17 October 2026, open calendar4 min read

Screenshot: Collabora Productivity / Wikimedia Commons (CC BY-SA 4.0)

Listen

Free browser voice. Starts at once.

Uses text-to-speech.

Attackers have been exploiting a critical flaw in an optional Nextcloud app that runs Collabora's document editor, planting webshells and hunting for passwords and crypto wallets on the servers they get into. The bug is CVE-2026-110447. It affects the Collabora Online Built-in CODE Server app, known in Nextcloud as richdocumentscode, before version 26.4.303.

A presentation open in Nextcloud Office, powered by Collabora Online, with slide thumbnails and a toolbar — Screenshot: Collabora Productivity / Wikimedia Commons (CC BY-SA 4.0)

Read next

More in Hacking →

Say hello in our guest book

Published

Quin Halberg Saturday 17 October 2026 at 9:35 pm Adelaide, open calendar4 min read

This desk has not corrected this file. Corrections.

The paper

Comments

No notes on this story yet.

Sign in to comment