Nextcloud Servers Backdoored via Collabora Built-in CODE Server Flaw — Web Shell Detection and Remediation Guide | Security Arsenal

Self-hosted Nextcloud administrators are facing an active, in-the-wild threat. Attackers have been observed exploiting a flaw in the optional Collabora Online – Built-in CODE Server app to plant web shells on vulnerable Nextcloud instances, granting them remote command execution with the privileges of the web server account. According to administrator reports on GitHub, the earliest logged attack occurred on September 10, 2026 — meaning this campaign has likely been running for weeks before broader detection.

If you run a Nextcloud instance with the Built-in CODE Server app enabled, assume exposure until verified otherwise. A web shell is one of the most versatile footholds an attacker can establish: arbitrary command execution, lateral movement into adjacent services, data exfiltration from user files, and deployment of second-stage payloads including ransomware. This post breaks down the attack chain, gives your SOC concrete detection content, and walks through containment and remediation.

Technical Analysis

Affected Product

Product: Nextcloud Server (self-hosted), with the optional app Collabora Online – Built-in CODE Server (richdocumentscode)
Component at risk: The Built-in CODE Server bundles a Collabora Online Development Edition (CODE) instance directly inside the Nextcloud app so administrators don't have to run a separate Collabora server or Docker container. This convenience comes with a large attack surface: an embedded web service, its own HTTP endpoints, and an office-document rendering engine, all running under the web server user (typically www-data, nginx, or apache).
Attack vector: Exploitation occurs over HTTP against the exposed CODE endpoints, after which the attacker writes a web shell into a web-accessible directory on the Nextcloud host.

No CVE identifier has been publicly assigned to this flaw at the time of writing, and vendor confirmation of exact affected version ranges is still emerging. Treat all versions of the Built-in CODE Server app installed prior to the latest available update as potentially vulnerable.

How the Attack Works

From the defender's perspective, the observed chain is:

Reconnaissance: Attackers enumerate internet-facing Nextcloud instances and fingerprint the presence of the Built-in CODE Server app (characteristic URL paths such as /apps/richdocumentscode/ or /index.php/apps/richdocumentscode/proxy.php).
Exploitation: A crafted request to the CODE server's exposed endpoints results in arbitrary file write or code execution in the context of the web server process.
Web shell deployment: The attacker drops a PHP (or script) web shell — a small file that executes commands passed via HTTP parameters — into a web-accessible location such as the Nextcloud data/ directory, apps/ directory, or the web root.
Post-exploitation: Interactive command execution as the web server user: reading Nextcloud config (config/config.php contains database credentials and secret/passwordsalt values), accessing all user files in the data directory, establishing reverse shells, and staging persistence.

Exploitation Status

Actively exploited in the wild: Confirmed — at least three independent administrator reports on GitHub describe real intrusions.
First observed attack: September 10, 2026.
PoC availability: Details are circulating via the GitHub issue reports; a working exploit path is clearly in the hands of multiple actors.
CISA KEV: Not listed at time of writing — monitor for addition.

The critical implication: a web shell on disk means you are not dealing with a vulnerability — you are dealing with an incident. Patching alone does not remove an implanted shell.

Detection & Response

Sigma Rules

YAML

---
title: Web Server Process Spawning Suspicious Child Process on Nextcloud Host
id: 4f8c2e71-9b3d-4a62-bc45-7e1d9f0a2c83
status: experimental
description: Detects web server worker processes (Apache, Nginx, PHP-FPM) spawning shells or scripting interpreters, a hallmark of web shell execution on compromised Nextcloud/Collabora CODE servers.
references:
  - https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.persistence
  - attack.execution
  - attack.t1505.003
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
      - '/httpd'
      - '/php'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Nextcloud cron jobs and preview generation typically execute as CLI php processes, not as children of the web server worker
  - Legitimate admin tooling invoked through occ web workflows is rare and should be investigated when seen
level: high
---
title: Web Shell File Creation in Nextcloud Web-Accessible Directories
id: 8a1e5b94-3c67-4f29-ad81-2b6e4c0f5a17
status: experimental
description: Detects creation or modification of PHP script files in Nextcloud data, app, or upload directories where new scripts should rarely appear, consistent with web shell deployment via the Collabora Built-in CODE Server flaw.
references:
  - https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/nextcloud/data/'
      - '/nextcloud/apps/'
      - '/nextcloud/tmp/'
      - '/nextcloud/updater-'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  condition: selection
falsepositives:
  - Nextcloud app updates and occ maintenance operations legitimately write PHP files under apps/ — correlate with maintenance windows and update events
  - The data/ directory should never contain newly written PHP from user uploads; treat hits there as high confidence
level: high
---
title: HTTP Requests to Collabora Built-in CODE Server Proxy Followed by Suspicious Parameters
id: 2d7b9f36-5a14-4c80-9e62-1c3a8d4b7f05
status: experimental
description: Detects web requests targeting the Nextcloud richdocumentscode proxy endpoint containing command-execution style parameters, indicative of web shell interaction or exploit probing.
references:
  - https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
logsource:
  category: webserver
detection:
  selection_uri:
    c-uri|contains:
      - '/richdocumentscode/'
      - '/proxy.php'
  selection_param:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'shell='
      - 'system('
      - 'base64_decode'
      - 'passthru'
      - 'popen'
  condition: all of selection_*
falsepositives:
  - Legitimate Collabora CODE proxy traffic carries document session parameters; requests carrying OS-command style tokens are strongly anomalous
level: critical

KQL (Microsoft Sentinel / Defender)

If you ingest Linux Syslog, web server logs (via CEF), or Defender for Endpoint telemetry from your Nextcloud hosts, hunt with the following queries:

KQL — Microsoft Sentinel / Defender

// Hunt 1: Web server processes spawning shells/interpreters (Defender for Endpoint on Linux)
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("apache2", "nginx", "php-fpm", "httpd", "php")
| where FileName in~ ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, RemoteIP
| order by TimeGenerated desc;

// Hunt 2: Requests to the Collabora Built-in CODE proxy endpoint with suspicious query tokens (web logs via CEF/Syslog)
CommonSecurityLog
| where TimeGenerated > ago(45d)
| where RequestURL has_any ("richdocumentscode", "proxy.php")
| where RequestURL has_any ("cmd=", "exec=", "shell=", "system(", "base64_decode", "passthru", "popen")
    or AdditionalExtensions has_any ("cmd=", "base64_decode", "system(")
| project TimeGenerated, SourceIP, RequestMethod, RequestURL, ApplicationProtocol,
          DestinationHostName, DestinationPort, DeviceVendor
| order by TimeGenerated desc;

// Hunt 3: New PHP files appearing in Nextcloud data directories (Syslog auditd/FIM ingestion)
Syslog
| where TimeGenerated > ago(30d)
| where SyslogMessage has_all ("/nextcloud/data/", ".php")
    or SyslogMessage has_all ("richdocumentscode", ".php")
| project TimeGenerated, Computer, Facility, SyslogMessage
| order by TimeGenerated desc;

Velociraptor VQL

Deploy this artifact across your Nextcloud fleet to triage for planted web shells and suspicious child processes of the web server:

VQL — Velociraptor

-- Triage Nextcloud hosts for web shells and web-server-spawned processes
-- Combines recently modified PHP files in web-accessible paths with live process inspection

LET recent_php = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
    '/var/www/**/nextcloud/data/**/*.php',
    '/var/www/**/nextcloud/apps/**/*.php',
    '/var/www/html/**/*.php',
    '/srv/www/**/*.php'
])
WHERE Mtime > now() - 86400 * 30
  AND FullPath =~ 'data/'

LET suspicious_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(sh|bash|dash|nc|ncat|socat|python|perl)$'
  AND Username =~ '(?i)(www-data|nginx|apache|http)'

SELECT 'recent_php_file' AS Artifact, FullPath AS Indicator,
       Mtime AS Timestamp, '' AS CommandLine
FROM recent_php
UNION ALL
SELECT 'suspicious_process' AS Artifact, Name AS Indicator,
       CreateTime AS Timestamp, CommandLine
FROM suspicious_procs

For deeper forensic triage, also collect the CODE app logs (/var/log/apache2/, /var/log/nginx/, and the Nextcloud log at data/nextcloud.log) and review requests to proxy.php around and after September 10, 2026.

Remediation Script

The following Bash script audits a Nextcloud host for indicators of this campaign and disables the vulnerable app. Run it as root or with sudo on each Nextcloud server. It does not replace forensic analysis — if it finds anything, treat the host as compromised.

Bash / Shell

#!/bin/bash
# Security Arsenal — Nextcloud / Collabora Built-in CODE Server compromise triage
# Run as root. Set NC_PATH to your Nextcloud installation root.

NC_PATH="/var/www/nextcloud"
WEB_USER="www-data"   # change to nginx/apache as appropriate
REPORT="/root/nextcloud_triage_$(date +%Y%m%d_%H%M%S).txt"

echo "=== Nextcloud / CODE Server Triage — $(date) ===" | tee "$REPORT"

# 1. Is the Built-in CODE Server app installed and enabled?
echo -e "\n[*] App status:" | tee -a "$REPORT"
sudo -u "$WEB_USER" php "$NC_PATH/occ" app:list 2>/dev/null | grep -i richdocuments | tee -a "$REPORT"

# 2. Hunt for PHP files in the data directory (should never contain executable PHP from uploads)
echo -e "\n[*] PHP files under data/ (HIGH CONFIDENCE IoC):" | tee -a "$REPORT"
find "$NC_PATH/data" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -newermt "2026-09-01" -ls 2>/dev/null | tee -a "$REPORT"

# 3. Recently modified PHP in apps/ and web root
find "$NC_PATH/apps" "$NC_PATH" -maxdepth 1 -type f -name "*.php" -newermt "2026-09-10" -ls 2>/dev/null | tee -a "$REPORT"

# 4. Grep for classic web shell signatures across the web tree
echo -e "\n[*] Web shell signature scan:" | tee -a "$REPORT"
grep -rEl --include="*.php" \
  '(eval\s*\(\s*base64_decode|assert\s*\(\s*\$_(GET|POST|REQUEST)|system\s*\(\s*\$_(GET|POST|REQUEST)|passthru\s*\(\s*\$_(GET|POST|REQUEST)|shell_exec\s*\(\s*\$_(GET|POST|REQUEST)|popen\s*\(\s*\$_)' \
  "$NC_PATH" 2>/dev/null | tee -a "$REPORT"

# 5. Suspicious child processes of the web server (live snapshot)
echo -e "\n[*] Shells/interpreters running as web user:" | tee -a "$REPORT"
ps -u "$WEB_USER" -o pid,ppid,comm,args 2>/dev/null | grep -Ei '(bash|sh$|nc |ncat|socat|python|perl)' | grep -v grep | tee -a "$REPORT"

# 6. Access log review for CODE proxy exploitation attempts
echo -e "\n[*] Suspicious requests to richdocumentscode/proxy.php since Sept 10:" | tee -a "$REPORT"
grep -E "richdocumentscode|proxy\.php" /var/log/apache2/access.log* /var/log/nginx/access.log* 2>/dev/null | \
  grep -Ei "(cmd=|exec=|shell=|base64_decode|system\(|passthru|\.php\?)" | tail -50 | tee -a "$REPORT"

# 7. IMMEDIATE CONTAINMENT: disable the vulnerable app until patched
echo -e "\n[*] Disabling richdocumentscode app (containment):" | tee -a "$REPORT"
sudo -u "$WEB_USER" php "$NC_PATH/occ" app:disable richdocumentscode 2>&1 | tee -a "$REPORT"

echo -e "\n=== Triage complete. Report saved to $REPORT ==="
echo "If sections 2-6 returned hits: isolate the host, preserve evidence, and initiate IR."

Remediation

Disable the Built-in CODE Server app immediately on every Nextcloud instance: occ app:disable richdocumentscode. If your organization genuinely needs in-browser document editing, migrate to a standalone Collabora Online server (or the official Docker image) behind a properly segmented reverse proxy rather than the bundled CODE app — this removes the embedded service from the web server's trust domain entirely.
Update everything: Apply the latest Nextcloud server release and update all apps, including richdocumentscode, as soon as the vendor ships a fixed build. Monitor the Nextcloud security advisories and the GitHub issue reports for the official fix and affected-version disclosure.
Assume breach — sweep for web shells before and after patching. Patching closes the door; it does not evict anyone already inside. Run the triage script above, inspect data/ for PHP files, review access logs back to at least September 10, 2026, and diff the apps/ and installation directories against a clean package of the same version.
If a web shell is found, treat it as a full incident: isolate the host from the network, preserve volatile data and logs, rotate all secrets in config/config.php (database password, secret, passwordsalt), force password resets for all Nextcloud users, invalidate sessions (occ user:reset-password and session table cleanup), and audit for lateral movement — database credentials harvested from the config are a common pivot.
Harden going forward:
- Block outbound egress from Nextcloud hosts except to required update/collaboration endpoints — this neuters reverse shells and C2.
- Disable PHP execution in the data/ directory at the web server level (for Nginx: a location block returning 403 for *.php under the data path; for Apache: php_admin_flag engine off on the data directory). Nextcloud never needs to execute PHP from data/ — this single control kills most web shells planted there.
- Deploy file integrity monitoring on the web root and app directories.
- Restrict administrative app installation to maintenance windows and monitor occ app:install / app directory writes.
- Forward web access logs, auth logs, and Nextcloud's audit log to your SIEM with alerting on proxy.php anomalies.

Bottom Line

Convenience apps that embed entire services inside a web application's trust boundary are exactly where attackers look first — the Built-in CODE Server is a full office-suite server living inside your file-sharing platform. If you run it, disable it today, hunt back to September 10, and rebuild your document-editing capability on an isolated Collabora deployment. And remember: a patch without a compromise assessment is an unfinished remediation.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub

Nextcloud Servers Backdoored via Collabora Built-in CODE Server Flaw — Web Shell Detection and Remediation Guide