What happened

• Attackers exploited a command-injection flaw in proxy.php of the richdocumentscode app before 26.4.303 using unauthenticated GET requests to /apps/richdocumentscode/proxy.php?status containing $(...), ${IFS} and base64 -d|sh [S1].
• The flaw is reported reachable only while the built-in CODE server is stopped, for example after a restart, upgrade or crash [S3].
• Payloads wrote shx*.php web shells into the app folder and tried to send uname -a output to a webhook.site address [S1][S2].
• The shells were used to search for password vaults, password-manager artifacts and cryptocurrency wallets [S1][S3].
• One admin learned of the break-in from emails about failed sudo attempts by the server [S2].
• Affected admins report attacks dating to September 10 [S1][S3].

Timeline

Detect

Injection attempts against richdocumentscode proxy.php · Web server access log

index=* "/apps/richdocumentscode/proxy.php" ("%24%28" OR "$(" OR "IFS" OR "%2e%2e" OR "base64") earliest=09/01/2026:00:00:00 | stats count min(_time) as first max(_time) as last values(status) as status by host src http_user_agent

A hit means: A request matching the reported exploit pattern reached the app. On its own this shows an attempt; a 200 response or a follow-on shx*.php request points to success [S1].

Requests to generated web shells · Web server access log

index=* "/apps/richdocumentscode/" ".php" | regex _raw="/apps/richdocumentscode/sh[a-z]?[0-9a-f]{4,6}\.php" | stats count min(_time) as first values(status) as status by host src

A hit means: Someone requested a shx*.php file in the app folder, the reported web shell naming. A 200 response means a shell likely exists and was used [S1][S2].

Known indicators · Proxy, DNS, firewall, web and EDR logs

index=* ("89.38.98.50" OR "139.28.18.122" OR "webhook.site" OR "4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562" OR "shxa35d0.php" OR "shxd33ce.php" OR "shx13a86.php" OR "shx5cf91.php" OR "shxf4645.php" OR "shx56367.php" OR "shrf4645.php") | stats count min(_time) as first by host src dest

A hit means: Contact with or presence of an indicator listed in reporting. webhook.site is a public service, so a server-originated connection to it is the meaningful case [S2].

sudo attempts by the web server account · Linux auth log

index=* sudo ("www-data" OR "apache" OR "nginx") ("authentication failure" OR "NOT in sudoers" OR "incorrect password" OR "COMMAND=") | stats count min(_time) as first by host user

A hit means: The web server account tried to escalate privileges, the signal one victim first noticed [S2].

Verify

• Confirm the host runs Nextcloud with the richdocumentscode app below 26.4.303 [S1].
• Look for shx*.php files in the app folder; reported shells contain shell_exec on the c GET parameter [S1][S2].
• Run the Nextcloud integrity check for unexpected files in the app directory [S1].
• Correlate a proxy.php?status injection request with a later shx*.php file or request and outbound traffic to webhook.site [S1][S2].
• Benign look-alike: normal proxy.php?status polling without $(, ${IFS}, %2e%2e or base64 in the path.
• Benign look-alike: internet scanners sending the pattern to hosts without the app, which return 404.

Scope

Affected

• Nextcloud servers running the Collabora Online Built-in CODE Server app (richdocumentscode) before 26.4.303 [S1]

Only if

• The built-in CODE server is stopped, for example after a restart, upgrade or crash [S3]
• proxy.php is reachable by the attacker; no authentication is required [S1][S3]

Not affected if

• richdocumentscode is not installed or is at 26.4.303 or later [S1]

Fixed in: richdocumentscode 26.4.303 [S1]

Enumerate

• All Nextcloud instances, including shadow or departmental ones, and whether each is internet-facing
• richdocumentscode app version on each instance
• Files in each apps/richdocumentscode directory created since September 10
• Secrets readable by the web server account on affected hosts: vaults, keys, wallets and config credentials
• Other hosts reachable from an affected Nextcloud server

Contain

• Preserve first: copy web access logs back to September 10, any shx*.php files and a disk or memory image of suspect hosts.
• Remove internet exposure or disable the richdocumentscode app on any unpatched instance, then update it to 26.4.303 [S1].
• Block 89.38.98.50, 139.28.18.122 and server egress to webhook.site [S2].
• On confirmed hosts, isolate the server and rotate every credential readable by the web server account. Data already read cannot be recalled, so rotation is mandatory, not optional [S1].
• Deleting web shells or rebuilding the host destroys evidence and cannot be undone; do it only after preservation.

Eradicate

• Remove shx*.php and similar dropped PHP files from the app folder [S1][S2].
• Update richdocumentscode to 26.4.303 or later to remove the injection root cause [S1].
• Check for other persistence beyond the reported web shells; the sources do not describe any.

Recover

• Before restoring, confirm the app is at 26.4.303 or later, the integrity check is clean and no shx*.php files remain.
• Afterwards, monitor proxy.php?status requests with injection characters, new PHP files in the app folder, sudo use by the web server account and egress to webhook.site [S1][S2].
• Watch rotated accounts and any wallets for misuse.

Re-enter the loop when

• A vendor or CERT advisory is published that changes affected versions, the fix or the stopped-server precondition.
• New IoCs, shell names or attacker infrastructure are reported.
• Exploitation is reported while the CODE server is running, or against other Collabora or Nextcloud components.
• Evidence appears of lateral movement or credential use beyond the Nextcloud host.

Debrief

• Record the earliest exploit request found against the reported September 10 start.
• Record whether the CODE server was stopped at the time of compromise.
• Record which secrets were readable and which were rotated.
• Source gap: no vendor advisory, CVSS or official disclosure date is among the sources.
• Source gap: no description of post-exploitation persistence beyond web shells.
• Source gap: no exfiltration evidence has been reported.

Detection coverage — checked automatically

Checked automatically 2026-10-31 22:22Z from public sources: 6 published, 21 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-110447

cpe:"cpe:/a:collabora:collabora_online_-_built-in_code_server"

product:"Collabora Online - Built-in Code Server"

host.services: (software.product = "Collabora Online - Built-in Code Server")

http.html:"Collabora Online Development Edition"

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 22:22Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• No vendor (Nextcloud or Collabora) advisory or NVD entry is among the sources; affected and fixed versions rest on news reporting [S1].
• The stopped-CODE-server precondition comes only from S3; is it confirmed by the vendor?
• Story dates are out of order: the thread says oldest first, but the first story is dated 2026-10-16, after the 2026-10-15 brief date.
• The two stories assign different priorities (P1 in S3, P2 in S1); this card uses P2 with a P1 escalation trigger.
• The listed user agent is a generic Chrome string, and how the IPs relate to attacks is not stated in the summaries.
• The sha256 is not attributed to a specific file in the input.

Sources

• [S1] https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html · The Hacker News
• [S2] https://github.com/CollaboraOnline/richdocumentscode/issues/354 · GitHub
• [S3] https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/ · BleepingComputer

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.