OCTOBER 2026 — PATCH SPRINT

Nextcloud CVE patch planner: October 2026 sprint — the cybersecurity news patch planner

The October 2026 Nextcloud patch sprint is the month admins had to ship the critical Collabora CODE fix for CVE-2026-110447 alongside three Hub 26 maintenance updates. This cybersecurity news planner puts them in the right order so one maintenance window covers both.

Reviewed October 18, 2026 — Ingenious AI security check.

Which Nextcloud patch goes first in this cybersecurity news sprint?

The Collabora CODE fix goes first — CVE-2026-110447 was exploited in the wild, so it outranks routine maintenance. Patch Collabora, verify the fixed build, then roll the three Hub 26 updates in the same window. Doing them in the wrong order wastes the maintenance window and leaves the exploited flaw open longer.

What is a patch planner?

A sequenced checklist that puts security fixes in the right order — here, the exploited Collabora CODE flaw before routine Hub 26 maintenance — so one maintenance window covers everything.

October handed Nextcloud admins two jobs at once: the critical Collabora CODE fix (CVE-2026-110447, exploited in the wild) and three Hub 26 maintenance updates. Do them in the wrong order and you waste a maintenance window — or worse, patch the Hub while the RCE is still open. One checklist, right order, progress tracked — your Nextcloud CVE patch plan.

Your October updates

Hub 26 Winter → 33.0.10 · Spring → 34.0.5 · Summer → 35.0.2 — bug fixes, stability and security upgrades. Staged rollout starting at 30% of instances. (via help.nextcloud.com)

richdocumentscode → 26.4.303+ — fixes CVE-2026-110447 (unauthenticated RCE, exploited Sept–Oct 2026). Requires Nextcloud 30+. Disabling the app does not fix it.

The sprint checklist — in order

0 of 6 steps complete

1Back up files + database — and trust the backupA backup you haven't test-restored is a hope, not a backup. Confirm the dump is recent and complete before touching anything. 2Snapshot the VM / container if you canYour rollback path if an update goes sideways. No snapshot capability? Make sure step 1 is airtight instead. 3Triage the critical fix FIRST: the CODE appUpdate "Collabora Online – Built-in CODE Server" to 26.4.303+ or remove it entirely — this CVE is exploited in the wild and needs no authentication. Disabling doesn't count. On Nextcloud ≤29? There is no safe app version: upgrade Nextcloud or remove the app (see the EOL trap). 4Apply your Hub maintenance updateWinter → 33.0.10, Spring → 34.0.5, Summer → 35.0.2. Staged rollout at 30% — if your updater doesn't offer it yet, that's normal; don't switch to beta channels to force it. 5Verify post-updatesudo -u www-data php occ app:list | grep richdocumentscode — confirm ≥26.4.303 or absent. sudo -u www-data php occ --version — confirm your Hub target version. 6Hunt, then watchIf the server was ever exposed during Sept–Oct 2026, run the webshell-leftovers hunt — patching doesn't remove planted shells. Then keep an eye on help.nextcloud.com and your logs for a week.

Sprint not started. Work the steps in order — step 3 (the CODE fix) is the one attackers care about.

Sources

Maintenance updates: help.nextcloud.com · nextcloud.com blog · CVE-2026-110447: The Hacker News · Censys

Keep going

See the 34-day disclosure timeline →

Exposure quiz · Crown-jewels audit

FROM INGENIOUS AI

Ingenious AI builds 11 AI security platforms — disclosure compliance, rogue-agent defense, breach hunting, agent oversight, and more.

All 11 platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI

Our platforms are being upgraded and return November 1 — get early access now:

Get early access on WhatsApp →

What are the October 2026 Nextcloud maintenance updates?

Per the October 16, 2026 announcement: Nextcloud Hub 26 Winter updates to 33.0.10, Spring to 34.0.5, and Summer to 35.0.2. They include bug fixes, stability and security upgrades. The rollout is staged, starting at 30% of instances.

Should I update the Collabora app or Nextcloud Hub first?

Triage the critical one first: the built-in Collabora CODE Server app (CVE-2026-110447, exploited in the wild) should be updated to 26.4.303+ or removed before anything else. Then apply your Hub maintenance update. If you're on Nextcloud 29 or older, there is no safe app version — upgrade Nextcloud or remove the app.

My updater doesn't show the October update yet — is something wrong?

Probably not. Nextcloud rolls out maintenance updates in stages, starting at 30% of instances, so yours may simply not be in the first wave. Don't force it by switching to beta channels; wait for your wave or update manually from a backup.

Is Nextcloud safe?

Nextcloud itself remains safe to use when kept updated — the October 2026 incident was a critical flaw (CVE-2026-110447) in one optional app, the built-in Collabora CODE server, not in Nextcloud core. Stay on a supported release, apply maintenance updates promptly, and remove apps you do not use.

How do I check if my Nextcloud is vulnerable?

Check whether the ‘Collabora Online – Built-in CODE Server’ app (richdocumentscode) is installed and older than 26.4.303 — via Admin > Apps or ‘occ app:list’. If the app was present at any point in September–October 2026, assume exposure and hunt for web shells even after patching.

What should I do if my Nextcloud was hacked?

Take the server offline, restore from a clean backup or rebuild it, and rotate every credential the server touched. Hunt for leftover PHP web shells — patching CVE-2026-110447 does not remove shells attackers already planted — then update the Collabora app to 26.4.303+ or remove it.