Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Threat actors are exploiting a critical command execution vulnerability in Collabora Online’s Built-in CODE Server app for Nextcloud (richdocumentscode). Attacks reportedly began in mid-September and included the deployment of PHP webshells. Some users reported ransomware operators exploiting the flaw, but this could not be independently confirmed.