Attackers backdoor Nextcloud servers via flaw in Collabora's built-in CODE app
An unauthenticated command injection in Nextcloud's optional Built-in CODE Server app, now tracked as CVE-2026-110447, has been used since September to plant PHP web shells.