decrypted · 24 october 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

Nextcloud's built-in Collabora server was exploited for a month before the advisory

A fix for a critical Nextcloud flaw shipped on 11 September. The advisory arrived on 14 October, and in between attackers were already using it. On 23 October CISA added CVE-2026-110447, the public reference number for the flaw, to its KEV list, the catalogue of flaws known to be exploited in real attacks. The bug sits in the built-in Collabora Online server that many self-hosted Nextcloud installs use for editing documents. If your organisation runs Nextcloud to keep files under its own roof, check nobody else has been let in.

What the flaw does

The vendor advisory rates it critical, 9.2 on the CVSS v4 scale, the zero-to-ten severity score. An unauthenticated request to the app's proxy can make the server run an operating system command as the web server user. Versions before 26.4.303 are affected. Standalone Collabora Online, Docker and RPM/DEB installs and Nextcloud All-in-One are reported unaffected.

Think of a building whose side door unlocks only when the night porter is off shift. The attack works only while the bundled server is not running, which happens after a restart, an upgrade or a crash. Nobody needs to log in.

What the attackers did

BleepingComputer reports administrator logs showing attacks from 10 September. The intruders planted PHP webshells, small scripts that give remote control through an ordinary web page, and searched for password databases, password manager files and cryptocurrency wallets. Reports of ransomware are unconfirmed.

A defender would look for:

Check logs back to at least 10 September. Disabling the app does not close the hole, so update it or remove it, and patching does not remove a webshell already planted. If you find one, treat everything the web server account could read as exposed and consider a rebuild.

The paperwork lagged the fix

Nextcloud said Collabora reported the flaw in mid-September, that an update went out through the app store, and that it had not seen widespread exploitation. Collabora blamed CVE processing backlogs at GitHub. BleepingComputer cites a Second Security study putting the median gap between a public fix and a CVE at 39 days in August, up from 5.1 in January. My inference: a scanner keyed to CVE numbers had nothing to flag for a month.

The Secure by Design lesson

Request data should never get near a shell command, and a component that can be left stopped should fail closed, not open. For UK organisations the remedies are unglamorous:

I found no UK-specific victim figures. Self-hosting buys control over your data, but control includes noticing when a vendor fixes something quietly.

Also this week

Microsoft puts AI agents behind the ConnectWise attacks. Microsoft said on 21 October that it assesses a China-aligned group it tracks as Storm-0940 was responsible for the ConnectWise supply chain compromise, using an AI penetration-testing framework called ARTEX. It says targeting began as early as September and covered hundreds of organisations, with sign-in attempts against more than 2,250 tenants. Its password-spray campaign peaked at 2,900 failed log-ons a minute on 11 October, and Microsoft saw no successful authentication in that spray. Separately, it reports privileged access in under three hours in multiple cases. The lesson is that defence at human speed is the casualty: lockouts, alerting and credential hygiene have to work without waiting for an analyst to arrive.

UK proposes 14 years for undersea cable sabotage. The government published a consultation on 22 October proposing up to 14 years in prison for deliberate damage, 10 for reckless damage and two for gross negligence, with unlimited fines. The DCMS paper says subsea cables carry approximately 99% of UK international data traffic, with 64 active cable systems landing in the UK, and it proposes statutory security and resilience requirements for operators. The consultation closes on 14 January 2027. If your business depends on a single international link, ask your provider now what the new duties would mean for you, and whether your resilience plan assumes the cable always works.

Sources

Want a second pair of eyes on your self-hosted services? get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.

Play here Loads Apple's player when you press it.