GoKawiilAttackers exploit unpatched Nextcloud Collabora flaw CVE-2026-110447 since September
Hackers have been exploiting a critical command injection vulnerability in Nextcloud's built-in Collabora Online CODE server app since at least September 10, weeks before the issue received a formal advisory and CVE number. The flaw lets unauthenticated attackers send a crafted request to the app's proxy.php endpoint and run system commands when the bundled CODE server is down, such as after a restart or crash, allowing them to plant PHP webshells and hunt for passwords and crypto wallets.