{"metadata": {"vulnerability": "CVE-2026-110447", "count": 42, "kinds": {"milestone": 4, "sighting": 25, "kev": 5, "other": 8}}, "data": [{"timestamp": "2026-10-14T02:27:41.637Z", "date_only": false, "value": "2026-10-14T02:27:41.637Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110447", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110447", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2026-110447", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.asserted_at", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.first_seen_at", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-110447", "field": "status.status_updated_at", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T02:40:18.583Z", "date_only": false, "value": "2026-10-14T02:40:18.583Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-110447", "field": "evidence.0.details.added_date", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T03:00:29.573Z", "date_only": false, "value": "2026-10-14T03:00:29.573165Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxskl4mgth23", "record": "cve-2026-110447", "field": "creation_timestamp", "uuid": "0c909fae-41b2-4a8b-bdf2-34bb66afe464", "content": "CRITICAL RCE (CVE-2026-110447) in Collabora Online Built-in CODE Server <26.4.303. Actively exploited since Sept 2026. Update to 26.4.303+ immediately. https://radar.offseq.com/threat/cve-2026-110447-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-f68ba52513af6...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxskl4mgth23"}, {"timestamp": "2026-10-14T03:00:32.017Z", "date_only": false, "value": "2026-10-14T03:00:32.017449Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117437027250345990", "record": "cve-2026-110447", "field": "creation_timestamp", "uuid": "96fb931f-de43-4b45-ab27-4090d04491b2", "content": "CVE-2026-110447 (CRITICAL, CVSS 9.2) allows RCE via OS command injection in Collabora Online Built-in CODE Server <26.4.303 (richdocumentscode, Nextcloud). Exploited in the wild since Sept 2026. Patch required. https://radar.offseq.com/threat/cve-2026-110447-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-f68ba52513af6028 #OffSeq #Infosec #Nextcloud #CVE2026110447", "url": "https://infosec.exchange/users/offseq/statuses/117437027250345990"}, {"timestamp": "2026-10-14T03:17:20Z", "date_only": false, "value": "2026-10-14T03:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F97P-R72Q-64H2", "record": "GHSA-F97P-R72Q-64H2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T03:17:20.683Z", "date_only": false, "value": "2026-10-14T03:17:20.683", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110447", "record": "FKIE_CVE-2026-110447", "field": "published"}, {"timestamp": "2026-10-14T03:30:39Z", "date_only": false, "value": "2026-10-14T03:30:39Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F97P-R72Q-64H2", "record": "GHSA-F97P-R72Q-64H2", "field": "published"}, {"timestamp": "2026-10-14T03:30:39Z", "date_only": false, "value": "2026-10-14T03:30:39Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F97P-R72Q-64H2", "record": "GHSA-F97P-R72Q-64H2", "field": "modified"}, {"timestamp": "2026-10-14T03:37:35.973Z", "date_only": false, "value": "2026-10-14T03:37:35.973258Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxsmnhyvaj23", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "1db72b8d-2341-48b2-84e8-a116c7f5218f", "content": "Attackers are actively exploiting CVE-2026-110447 (CVSS 9.2), a critical Nextcloud Collabora Online RCE flaw in richdocumentscode, to deploy PHP webshells.\n\n#CVE2026110447 #Nextcloud #CollaboraOnline #RCE #Webshell #Cybersecurity #InfoSec #354", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxsmnhyvaj23"}, {"timestamp": "2026-10-14T03:53:14.706Z", "date_only": false, "value": "2026-10-14T03:53:14.706763Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hp62asx5qito6", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "4591732b-7cf8-4345-9ac7-1630e8583198", "content": "CVE-2026-110447 - Collabora Online CODE Server OS Command Injection Vulnerability\nCVE ID : CVE-2026-110447\n \n Published : Oct. 14, 2026, 3:17 a.m. | 15\u00a0minutes ago\n \n Description : Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allo...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/hp62asx5qito6"}, {"timestamp": "2026-10-14T04:07:43.364Z", "date_only": false, "value": "2026-10-14T04:07:43.364372Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxsode47y42z", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "5553a998-c767-4ecb-a137-e476c6cfaba9", "content": "\ud83d\udea8 CVE-2026-110447 \u2014 CVSS 9.2 CRITICAL\n\nCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote c...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110447\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxsode47y42z"}, {"timestamp": "2026-10-14T08:20:04.146Z", "date_only": false, "value": "2026-10-14T08:20:04.146457Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxt4gl7hiv2n", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "0dc17112-dedd-4d24-9aa5-dc21a7320cc2", "content": "CVE-2026-110447 - collabora online - built-in code server\nThe Collabora Online app for Nextcloud that includes the built\u2011in CODE server (versions before 26.4.303) can be tricked into running any command you choose\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#collabora #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxt4gl7hiv2n"}, {"timestamp": "2026-10-14T16:25:34.658Z", "date_only": false, "value": "2026-10-14T16:25:34.658953Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440193104567100", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "3d734c97-11d3-4571-8f83-dffa82bd05f1", "content": "CVE-2026-110447  Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110447https://github.com/CollaboraOnline/richdocumentscode/issues/354https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516#nextcloud #Collabora #CollaboraOnline-Built-inCODEServer#CVE_2026_110447#bot", "url": "https://infosec.exchange/users/cve/statuses/117440193104567100"}, {"timestamp": "2026-10-14T18:05:02.800Z", "date_only": false, "value": "2026-10-14T18:05:02.800265Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110447", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T18:05:02.800Z", "date_only": false, "value": "2026-10-14T18:05:02.800265Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110447", "record": "FKIE_CVE-2026-110447", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T18:42:30.493Z", "date_only": false, "value": "2026-10-14T18:42:30.493692Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mxu77lfqiy25", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "9a7bb128-413e-462b-a1fb-d340250d9ce7", "content": "CVE-2026-110447 is trending. Hype score 5, currently #6 on cvemon.\n\nCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-110447", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mxu77lfqiy25"}, {"timestamp": "2026-10-14T19:05:08.552Z", "date_only": false, "value": "2026-10-14T19:05:08.552Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110447", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:05:08.552Z", "date_only": false, "value": "2026-10-14T19:05:08.552Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110447", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:10.487Z", "date_only": false, "value": "2026-10-14T19:17:10.487", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110447", "record": "FKIE_CVE-2026-110447", "field": "lastModified"}, {"timestamp": "2026-10-14T20:33:16.802Z", "date_only": false, "value": "2026-10-14T20:33:16.802285Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117441167065150392", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "77290010-3da9-435e-a024-d739ae243ee5", "content": "Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora\u2019s Built-in CODE App\nAttackers have exploited a flaw in the Collabora Online built-in CODE app for Nextcloud to plant web shells on servers, The Hacker News reports. The unauthenticated command-execution flaw (CVE-2026-110447) can be triggered when the app\u2019s local document server is stopped, such as during a restart or upgrade; Collabora fixed it in September and warns that disabling the app is not enough \u2014 it must be updated or removed. https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html", "url": "https://infosec.exchange/users/edwardk/statuses/117441167065150392"}, {"timestamp": "2026-10-15T03:00:01Z", "date_only": false, "value": "2026-10-15T03:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.recorded_at", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-15T03:00:38.105Z", "date_only": false, "value": "2026-10-15T03:00:38.105594Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "d1f5568e-1ca4-4678-ab01-cb58c70d20ec", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/795dd9f8-bd1f-4b8e-ba63-4ef197066fcc"}, {"timestamp": "2026-10-15T07:10:57Z", "date_only": false, "value": "2026-10-15T07:10:57.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/7c14e182-c75e-41da-81e6-e676c4a04de8", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "e157f565-f1db-4cf5-862a-430efee60554"}, {"timestamp": "2026-10-15T11:36:25.792Z", "date_only": false, "value": "2026-10-15T11:36:25.792805Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxvxulvdvi2r", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "da71a14c-7fae-44d7-a405-a472716291d6", "content": "Attackers exploited CVE-2026-110447 in the built-in Nextcloud CODE app to run commands and plant web shells when its local server was down. Collabora fixed versions before 26.4.303; users must update or remove the app.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxvxulvdvi2r"}, {"timestamp": "2026-10-15T12:05:07.186Z", "date_only": false, "value": "2026-10-15T12:05:07.186981Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxvzhwdlpq27", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "d1c841f0-6016-4fbb-9101-d44e07028bde", "content": "Vuln\u00e9rabilit\u00e9s critiques (CVSS \u2265 9) \u00b7 1\n\u2022 Collabora Online (Nextcloud) (CVE-2026-110447), CVSS 9.2 (Cyberveille Esant\u00e9)", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mxvzhwdlpq27"}, {"timestamp": "2026-10-15T12:55:28.822Z", "date_only": false, "value": "2026-10-15T12:55:28.822135Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yogsec.bsky.social/post/3mxw4bvwkj22d", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "324a5535-93db-4411-8174-2b930c4d55ab", "content": "CVE-2026-110447\n\nCollabora Online Built-in CODE Server before 26.4.303, a Nextcloud app, allows remote code execution. OS command injection in proxy.php when the CODE server is not running, such as after a restart.\n\nnvd.nist.gov/vuln/detail/...\n\n#CVE #CollaboraOnline #InfoSec #RemoteCodeExecution", "url": "https://bsky.app/profile/yogsec.bsky.social/post/3mxw4bvwkj22d"}, {"timestamp": "2026-10-15T20:25:23.161Z", "date_only": false, "value": "2026-10-15T20:25:23.161939Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mxwvghcpe627", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "edd2396f-b042-4bec-ba5a-d65bb9346611", "content": "Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mxwvghcpe627"}, {"timestamp": "2026-10-15T20:33:40.928Z", "date_only": false, "value": "2026-10-15T20:33:40.928164Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxwvvcdcc32w", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "8f877ccd-fc5a-4bb5-8b9b-a1767108d4d0", "content": "Hacker\u304cCollabora Online \u306eRCE\u8106\u5f31\u6027\u3092\u60aa\u7528\u3001Nextcloud\u30b5\u30fc\u30d0\u30fc\u306b\u30d0\u30c3\u30af\u30c9\u30a2\u3092\u8a2d\u7f6e\n\n\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u3001Nextcloud\u5411\u3051\u30a2\u30d7\u30ea\u300cCollabora Online - Built-in CODE Server\u300d\uff08richdocumentscode\uff09\u306b\u5b58\u5728\u3059\u308b\u6df1\u523b\u306a\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u306e\u8106\u5f31\u6027\u300cCVE-2026-110447\u300d\u3092\u60aa\u7528\u3057\u3066\u3044\u307e\u3059\u3002 \u8907\u6570\u306e\u7ba1\u7406\u8005\u304b\u3089\u306e\u5831\u544a\u306b\u3088\u308b\u3068\u3001\u653b\u6483\u306f9\u6708\u4e2d\u65ec\u306b\u59cb\u307e\u3063\u3066\u3044\u307e\u3057\u305f", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxwvvcdcc32w"}, {"timestamp": "2026-10-15T21:23:48.684Z", "date_only": false, "value": "2026-10-15T21:23:48.684787Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxwyowsvy52t", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "32aed13f-2c66-4ee4-895b-97b4b1633d31", "content": "\ud83e\udd16 CVE-2026-110447: critical RCE in Collabora Online's CODE Server app (richdocumentscode) for Nextcloud, exploited in the wild to backdoor servers. Patch + audit for webshells.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-collaborarceflawtobackdoornextcloudservers/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxwyowsvy52t"}, {"timestamp": "2026-10-15T22:02:50.543Z", "date_only": false, "value": "2026-10-15T22:02:50.543106Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mxx2uq6ndl2r", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "1b46ac44-d917-4df2-a8eb-9781e6081b68", "content": "\ud83d\udd12 Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers\n\nThreat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora ...\n\nhttps://tinyurl.com/228aowq5 #CyberSecurity #InfoSec #CrustyTLDR", "url": "https://bsky.app/profile/crustytldr.bsky.social/post/3mxx2uq6ndl2r"}, {"timestamp": "2026-10-15T23:48:30.892Z", "date_only": false, "value": "2026-10-15T23:48:30.892187Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxxarnuy5s2n", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "145ba434-ac4e-4864-bb92-1a61c9e5d2bd", "content": "Attackers are exploiting CVE-2026-110447 in Nextcloud\u2019s optional built-in Collabora CODE app. Versions before 26.4.303 are affected; administrators should upgrade or remove the app. Some ransomware exploitation reports remain unconfirmed.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxxarnuy5s2n"}, {"timestamp": "2026-10-16T05:29:16.493Z", "date_only": false, "value": "2026-10-16T05:29:16.493560Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pickuma.bsky.social/post/3mxxtsygx3z2u", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "fdcc0f12-84b9-4f2a-92a8-3ec1b97de546", "content": "What the Collabora CODE flaw means for Nextcloud\n\nAttackers hit Nextcloud servers for a month before CVE-2026-110447 existed. Here is how to check if you run the vulnerable app and what to do.", "url": "https://bsky.app/profile/pickuma.bsky.social/post/3mxxtsygx3z2u"}, {"timestamp": "2026-10-16T05:33:10.216Z", "date_only": false, "value": "2026-10-16T05:33:10.216484Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxxtzy2sfj24", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "bd2b6309-9701-4dd9-940c-1239d4a1e89e", "content": "\ud83e\udd16 CVE-2026-110447: command injection in Nextcloud's Collabora \"Built-in CODE Server\" app, exploited since mid-Sept to drop webshells and steal creds. Fix: 26.4.303+\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxxtzy2sfj24"}, {"timestamp": "2026-10-16T05:56:29.608Z", "date_only": false, "value": "2026-10-16T05:56:29.608235Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mxxvdotjw52l", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "bc500aad-1471-49b2-95b9-0eaa35b098ee", "content": "\ud83d\udee1\ufe0f Revue cyber du 16 octobre :\n\n\u2022Collabora/Nextcloud : RCE CVE-2026-110447 exploit\u00e9e pour poser une backdoor.\n\u2022CERT-FR : Cisco AsyncOS CVE-2026-76519 exploit\u00e9 ; lot F5/Palo Alto/Juniper/Drupal.\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1325/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mxxvdotjw52l"}, {"timestamp": "2026-10-16T06:00:35.823Z", "date_only": false, "value": "2026-10-16T06:00:35.823909Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/it-connect.bsky.social/post/3mxxvky3q5g23", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "1bc905a9-1caa-4d15-a694-e122bc30ac77", "content": "#Nextcloud : une faille critique dans l'application #Collabora Built-in CODE (CVE-2026-110447) est exploit\u00e9e depuis le 10 septembre pour d\u00e9poser des webshells. D\u00e9sactiver l'application ne suffit pas. Comment vous prot\u00e9ger :\nwww.it-connect.fr/nextcloud-co...", "url": "https://bsky.app/profile/it-connect.bsky.social/post/3mxxvky3q5g23"}, {"timestamp": "2026-10-16T09:01:37.972Z", "date_only": false, "value": "2026-10-16T09:01:37.972583Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117449772079201201", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "f62d0e61-b669-43e4-9007-783ac6fdf7c4", "content": "Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers\nThreat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447, in the Collabora Online Built-in CODE Server app for Nextcloud. BleepingComputer reports the flaw is being used to backdoor Nextcloud servers. https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/", "url": "https://infosec.exchange/users/edwardk/statuses/117449772079201201"}, {"timestamp": "2026-10-16T09:01:39.087Z", "date_only": false, "value": "2026-10-16T09:01:39.087159Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxy7ora27u27", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "d18863a9-bc88-4596-8406-7228d18437d1", "content": "Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers\n\nThreat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447, in the Collabora Online Built-in CODE Server app for Nextcloud. BleepingComputer reports the flaw is being used to backdoor Nextcloud servers.", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxy7ora27u27"}]}