Changed since version 1

• Sources renumbered to match today's input: S1 is now BleepingComputer (was S3), S3 is The Hacker News (was S1); all references updated.
• Contain and eradicate: replaced 'disable the app' with upgrade or remove, since disabling is reported as insufficient [S1].
• Scope not_affected_if: added standalone, Docker/RPM/DEB and AIO Collabora deployments [S1].
• Scope enumerate: added deployment type, disabled-but-installed apps, and password databases and password manager artifacts [S1].
• What happened and verify: added attacker searches for password databases, password manager artifacts and wallets [S1].
• Verdict updated to upgrade or remove rather than update or disable [S1].
• Debrief source gap revised: the vendor advisory is now relayed by S1 but still not a direct source.

What happened

• A malicious request to the app's proxy.php endpoint triggers OS command injection; no authentication is required [S1].
• The flaw is reachable only while the built-in CODE server is stopped, for example after a restart, upgrade or crash [S1].
• Affected admins report attacks dating to September 10 [S1].
• Attackers planted PHP web shells and used them to search for password databases, password manager artifacts and cryptocurrency wallets [S1].
• Victims reported shx*.php web shells, outbound traffic to webhook.site and sudo attempts by the web server account [S2].
• Per the reported vendor advisory, only the built-in CODE server app is affected; the fix is richdocumentscode 26.4.303 or removing the app [S1].

Timeline

Detect

Injection attempts against richdocumentscode proxy.php · Web server access log

index=* "/apps/richdocumentscode/proxy.php" ("%24%28" OR "$(" OR "IFS" OR "%2e%2e" OR "base64") earliest=09/01/2026:00:00:00 | stats count min(_time) as first max(_time) as last values(status) as status by host src http_user_agent

A hit means: A request matching the reported exploit pattern reached the app. On its own this shows an attempt; a 200 response or a follow-on shx*.php request points to success [S1][S3].

Requests to generated web shells · Web server access log

index=* "/apps/richdocumentscode/" ".php" | regex _raw="/apps/richdocumentscode/sh[a-z]?[0-9a-f]{4,6}\.php" | stats count min(_time) as first values(status) as status by host src

A hit means: Someone requested a shx*.php file in the app folder, the reported web shell naming. A 200 response means a shell likely exists and was used [S2][S3].

Known indicators · Proxy, DNS, firewall, web and EDR logs

index=* ("89.38.98.50" OR "139.28.18.122" OR "webhook.site" OR "4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562" OR "shxa35d0.php" OR "shxd33ce.php" OR "shx13a86.php" OR "shx5cf91.php" OR "shxf4645.php" OR "shx56367.php" OR "shrf4645.php") | stats count min(_time) as first by host src dest

A hit means: Contact with or presence of an indicator listed in reporting. webhook.site is a public service, so a server-originated connection to it is the meaningful case [S2].

sudo attempts by the web server account · Linux auth log

index=* sudo ("www-data" OR "apache" OR "nginx") ("authentication failure" OR "NOT in sudoers" OR "incorrect password" OR "COMMAND=") | stats count min(_time) as first by host user

A hit means: The web server account tried to escalate privileges, the signal one victim first noticed [S2].

Verify

• Confirm the host runs Nextcloud with the built-in richdocumentscode app below 26.4.303, not a standalone, package or AIO Collabora deployment [S1].
• Look for shx*.php files in the app folder; reported shells run shell_exec on the c GET parameter [S2][S3].
• Run the Nextcloud integrity check for unexpected files in the app directory [S3].
• Correlate a proxy.php injection request with a later shx*.php file or request and outbound traffic to webhook.site [S2][S3].
• Check whether password databases, password manager files or wallets on the host were read after the first injection request [S1].
• Benign look-alike: normal proxy.php status polling without $(, ${IFS}, %2e%2e or base64 in the path.

Scope

Affected

• Nextcloud servers running the Collabora Online Built-in CODE Server app (richdocumentscode) before 26.4.303 [S1]

Only if

• The built-in CODE server is stopped, for example after a restart, upgrade or crash [S1]
• proxy.php is reachable by the attacker; no authentication is required [S1]

Not affected if

• richdocumentscode is not installed or is at 26.4.303 or later [S1]
• Collabora runs as a standalone server, from Docker, RPM or DEB packages, or as part of Nextcloud AIO [S1]

Fixed in: richdocumentscode 26.4.303 [S1]

Enumerate

• All Nextcloud instances, including shadow or departmental ones, and whether each is internet-facing
• Collabora deployment type per instance: built-in CODE app versus standalone, package or AIO
• richdocumentscode app version on each instance, including instances where it is disabled but still installed
• Files in each apps/richdocumentscode directory created since September 10
• Secrets readable by the web server account on affected hosts: password databases, password manager artifacts, keys, wallets and config credentials
• Other hosts reachable from an affected Nextcloud server

Contain

• Preserve first: copy web access logs back to September 10, any shx*.php files and a disk or memory image of suspect hosts.
• On any unpatched instance, upgrade richdocumentscode to 26.4.303 or remove the app; disabling it is reported as insufficient [S1]. Cut internet exposure until done.
• Block 89.38.98.50, 139.28.18.122 and server egress to webhook.site [S2].
• On confirmed hosts, isolate the server and rotate every credential readable by the web server account, including password manager and database contents. Data already read cannot be recalled [S1][S3].
• Deleting web shells or rebuilding the host destroys evidence and cannot be undone; do it only after preservation.

Eradicate

• Remove the vulnerable app version: upgrade to 26.4.303 or uninstall; a disabled app does not count [S1].
• Remove planted PHP web shells after preservation, and re-run the Nextcloud integrity check [S1][S3].
• Rotate secrets the shells could reach; the sources describe searches for password databases, password manager artifacts and wallets [S1].
• Sources describe no persistence beyond web shells; rebuild if any other change is found on the host.

Recover

• Before restoring, confirm the app is at 26.4.303 or later or removed, the integrity check is clean and no shx*.php files remain [S1].
• Afterwards, monitor proxy.php requests with injection characters, new PHP files in the app folder, sudo use by the web server account and egress to webhook.site [S1][S2].
• Watch rotated accounts, password manager vaults and any wallets for misuse.

Re-enter the loop when

• The vendor advisory changes affected versions or deployment types, or a fix newer than 26.4.303 appears.
• New indicators, web shell names or post-exploitation tooling are published.
• Exploitation is reported against standalone, package or AIO deployments, contradicting current guidance.
• Exfiltration or credential misuse is reported, or a host found where the app was only disabled.

Debrief

• Record the earliest exploit request found against the reported September 10 start.
• Record whether the CODE server was stopped at the time of compromise.
• Record which hosts had the app disabled rather than removed or upgraded.
• Record which secrets were readable and which were rotated.
• Source gap: the vendor advisory is relayed by S1 but not itself among the sources; no CVSS or official disclosure date is sourced.
• Source gap: no persistence beyond web shells and no confirmed exfiltration are described.

Detection coverage — checked automatically

Checked automatically 2026-10-31 22:47Z from public sources: 5 published, 22 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-110447

cpe:"cpe:/a:collabora:collabora_online_-_built-in_code_server"

product:"Collabora Online - Built-in Code Server"

host.services: (software.product = "Collabora Online - Built-in Code Server")

Banner spellings: a model read 5 from the NVD names and this card's text (former and marketing names, console titles); 0 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 22:47Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The prior draft's coverage metadata lists a CISA KEV entry dated 2026-10-23, after this brief's date of 2026-10-16; treat it as unverified until checked.
• CVSS and the NVD publication date are not in the sources.
• Does removing the app delete planted shells in its folder, destroying evidence?
• Why is disabling insufficient: is proxy.php still reachable when the app is disabled?
• The pipeline rated this P1; the card keeps P2 pending discovery of an affected host.

Sources

• [S1] https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/ · BleepingComputer

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.