Changed since version 3

• Hunt 4 now also matches uname -a, curl -skm and wget --no-check-certificate by the web server account; renamed to cover egress [S1][S2].
• Verify adds the reported base64 -d > sh*.php write pattern and the shell's default 'id' command [S1].
• Verify correlation now names curl or wget egress to webhook.site [S2].
• Recover monitoring now names curl or wget egress [S2].
• Added open questions on the source date and KEV date inconsistencies and on the conflicting P1 and P2 priorities.

What happened

• An OS command injection in proxy.php of the richdocumentscode app before 26.4.303 is reported exploited without authentication [S1][S3].
• The flaw is reported reachable only when the built-in CODE server is stopped, for example after a restart, upgrade or crash [S3].
• Unauthenticated GET requests to /apps/richdocumentscode/proxy.php?status carried $(...), ${IFS} and base64 -d|sh in the path and wrote shx*.php web shells [S1].
• The attacker sent the server's uname -a output to a webhook.site address [S2].
• The shells were used to search for password vaults, password manager artifacts and crypto wallets. One admin learned of the intrusion from failed sudo alerts for the web server account [S1][S2].
• Affected admins reported attacks dating to September 10 [S3].

Timeline

Detect

Injection attempts against richdocumentscode proxy.php · Web server access log

index=* "/apps/richdocumentscode/proxy.php" ("%24%28" OR "$(" OR "IFS" OR "%2e%2e" OR "base64") earliest=09/01/2026:00:00:00 | stats count min(_time) as first max(_time) as last values(status) as status by host src http_user_agent

FROM logs-* | WHERE @timestamp >= "2026-09-01T00:00:00Z" AND url.original LIKE "*/apps/richdocumentscode/proxy.php*" AND (url.original LIKE "*%24%28*" OR url.original LIKE "*$(*" OR url.original LIKE "*IFS*" OR url.original LIKE "*%2e%2e*" OR url.original LIKE "*base64*") | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), status = VALUES(http.response.status_code) BY host.name, source.ip, user_agent.original

A hit means: A request matching the reported exploit pattern reached the app. On its own this shows an attempt. A 200 response followed by a shx*.php request points to success [S1].

Requests to generated web shells · Web server access log

index=* "/apps/richdocumentscode/" ".php" earliest=09/01/2026:00:00:00 | regex _raw="/apps/richdocumentscode/sh[a-z]?[0-9a-f]{4,6}\.php" | eval c_param=if(match(_raw,"\.php\?c="),1,0) | stats count sum(c_param) as c_param_requests min(_time) as first values(status) as status by host src

FROM logs-* | WHERE @timestamp >= "2026-09-01T00:00:00Z" AND url.original RLIKE ".*/apps/richdocumentscode/sh[a-z]?[0-9a-f]{4,6}\\.php.*" | EVAL c_param = CASE(url.original LIKE "*.php?c=*", 1, 0) | STATS count = COUNT(*), c_param_requests = SUM(c_param), first = MIN(@timestamp), status = VALUES(http.response.status_code) BY host.name, source.ip

A hit means: Someone requested a file matching the reported shell naming. A 200 response, especially with ?c= such as ?c=id, means a shell likely exists and was used [S1][S2].

Known indicators · Proxy, DNS, firewall, web and EDR logs

index=* ("89.38.98.50" OR "139.28.18.122" OR "webhook.site" OR "4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562" OR "shxa35d0.php" OR "shxd33ce.php" OR "shx13a86.php" OR "shx5cf91.php" OR "shxf4645.php" OR "shx56367.php" OR "shrf4645.php" OR "Win64; x64) Chrome/126.0") | stats count min(_time) as first by host src dest

A hit means: Contact with, or presence of, an indicator supplied with this thread. webhook.site is a public service and the user agent is generic. The meaningful cases are a webhook.site connection originating from a server, or a shell filename [S2].

Web server account: egress, escalation and credential search · Linux auth log and EDR process events

index=* ("www-data" OR "apache" OR "nginx") (sudo OR "uname -a" OR "curl -skm" OR "--no-check-certificate" OR ".kdbx" OR "wallet.dat" OR "keystore.json" OR "bitwarden" OR "1password" OR ".electrum" OR ".bitcoin" OR ".monero" OR ".ethereum" OR "base64 -d") | stats count min(_time) as first values(process) as process by host user

FROM logs-* | WHERE user.name IN ("www-data", "apache", "nginx") AND (process.name == "sudo" OR process.command_line LIKE "*sudo*" OR process.command_line LIKE "*uname -a*" OR process.command_line LIKE "*curl -skm*" OR process.command_line LIKE "*--no-check-certificate*" OR process.command_line LIKE "*.kdbx*" OR process.command_line LIKE "*wallet.dat*" OR process.command_line LIKE "*keystore.json*" OR process.command_line LIKE "*bitwarden*" OR process.command_line LIKE "*1password*" OR process.command_line LIKE "*.electrum*" OR process.command_line LIKE "*.bitcoin*" OR process.command_line LIKE "*.monero*" OR process.command_line LIKE "*.ethereum*" OR process.command_line LIKE "*base64 -d*") | STATS count = COUNT(*), first = MIN(@timestamp), process = VALUES(process.command_line) BY host.name, user.name

A hit means: The web server account beaconed out, tried sudo, or searched for vaults and wallets, matching the reported post-exploitation steps. Treat the host as compromised and its secrets as exposed [S1][S2].

Verify

• Confirm the host runs Nextcloud with the built-in richdocumentscode app below 26.4.303, not a standalone, package or AIO Collabora deployment [S1][S3].
• Look for shx*.php files in the app folder. Reported shells contain shell_exec on $_GET['c'] with 'id' as the default [S1].
• Look for process events where sh, spawned by the PHP process, writes a file via base64 -d > sh*.php [S1].
• Run the Nextcloud integrity check for unexpected PHP files in the app directory [S1].
• Correlate a proxy.php injection request with a later shx*.php file or request, and with curl or wget egress from the server to webhook.site [S1][S2].
• Check process history after the first injection request for find or search commands targeting .kdbx, wallet.dat, keystore.json or password manager paths [S1].

Scope

Affected

• Nextcloud servers running the Collabora Online Built-in CODE Server app (richdocumentscode) before 26.4.303 [S1]

Only if

• The built-in CODE server is stopped, for example after a restart, upgrade or crash [S3]
• proxy.php is reachable by the attacker; no authentication is required [S1][S3]

Not affected if

• richdocumentscode is not installed or is at 26.4.303 or later [S1]
• Collabora runs as a standalone server, from Docker, RPM or DEB packages, or as part of Nextcloud AIO [S3]

Fixed in: richdocumentscode 26.4.303 [S1]

Enumerate

• All Nextcloud instances, including shadow or departmental ones, and whether each is internet-facing
• Collabora deployment type per instance: built-in CODE app versus standalone, package or AIO
• richdocumentscode app version on each instance, including instances where the app is disabled but still installed
• Files in each apps/richdocumentscode directory created since September 10
• Secrets readable by the web server account on affected hosts: password databases, password manager artifacts, keys, wallets and config credentials
• Other hosts reachable from an affected Nextcloud server

Contain

• Preserve evidence first: copy web access logs back to September 10, any shx*.php files and auth logs, and take a disk or memory image of suspect hosts.
• On any unpatched instance, upgrade richdocumentscode to 26.4.303 or remove the app. Disabling it is reported as insufficient [S1][S3]. Cut internet exposure until this is done.
• Block server egress to webhook.site [S2] and to the IPs supplied with this thread's indicators.
• On confirmed hosts, isolate the server and rotate every credential readable by the web server account, including password manager and database contents. Data already read cannot be recalled [S1][S3].
• Deleting web shells or rebuilding the host destroys evidence and cannot be undone. Do it only after preservation.

Eradicate

• Remove all shx*.php and similar sh*.php files from apps/richdocumentscode [S1].
• Upgrade richdocumentscode to 26.4.303 or later, or uninstall it [S1].
• Where secrets or escalation are confirmed, rebuild the host from a known-good image rather than cleaning it in place.

Recover

• Before restoring, confirm the app is at 26.4.303 or later or removed, the integrity check is clean, and no shx*.php files remain [S1].
• Afterwards, monitor for proxy.php requests with injection characters, new PHP files in the app folder, sudo use by the web server account, and curl or wget egress to webhook.site [S1][S2].
• Watch rotated accounts, password manager vaults and any wallets for misuse.

Re-enter the loop when

• Collabora or Nextcloud publishes an advisory that changes affected versions, the fix version or the stopped-server condition.
• Exploitation is reported against standalone, package or AIO Collabora deployments, which are currently stated as unaffected [S3].
• New shell names, IPs or exfiltration endpoints are published beyond those listed.
• Reporting describes persistence beyond web shells or confirmed data exfiltration.
• Any hunt finds a hit dated before September 10.

Debrief

• Record the earliest exploit request found, compared with the reported September 10 start [S3].
• Record whether the CODE server was stopped at the time of compromise.
• Record which hosts had the app disabled rather than removed or upgraded.
• Record which secrets were readable and which were rotated.
• Source gap: no vendor or CERT advisory is among the sources. The fix version and the disable-is-insufficient claim come from secondary reporting and a GitHub issue.
• Source gap: the sources describe no persistence beyond web shells and no confirmed exfiltration beyond uname -a to webhook.site.

Detection coverage — checked automatically

Checked automatically 2026-11-10 05:36Z from public sources: 6 published, 21 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-110447 — Nextcloud Collabora Built-in CODE app (richdocumentscode) RCE exploited to plant PHP web shells. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-110447

cpe:"cpe:/a:collabora:collabora_online_-_built-in_code_server"

product:"Collabora Online - Built-in Code Server"

host.services: (software.product = "Collabora Online - Built-in Code Server")

http.title:"Collabora Online"

http.html:"Built-in CODE Server"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

Banner spellings: a model read 5 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 05:36Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• S3 is dated 2026-10-16, after the 2026-10-15 brief date. Confirm its publication date.
• The prior draft's coverage block lists a CISA KEV entry dated 2026-10-23, after the brief date. Verify before relying on it.
• The two stories disagree on priority (P1 versus P2). Confirm the exposure assessment.
• No vendor advisory confirms the fix version or that disabling the app is insufficient.
• It is unclear which source first reported the curl -skm and wget --no-check-certificate commands.

Sources

• [S1] https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html · The Hacker News
• [S2] https://github.com/CollaboraOnline/richdocumentscode/issues/354 · GitHub
• [S3] https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/ · BleepingComputer

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.