CVE-2026-110447 — PATCHED ≠ CLEAN

Nextcloud CVE-2026-110447: you patched the RCE — are you actually clean? — a cybersecurity news persistence hunt

A webshell is a hidden backdoor attackers leave after breaching a server. This cybersecurity news checklist hunts webshell leftovers from Nextcloud CVE-2026-110447 — because patching is not enough.

Key figure: The global average cost of a data breach was $4.44 million in 2025 (IBM, Cost of a Data Breach Report 2025).

Reviewed October 18, 2026 — Ingenious AI security check.

Could leftover webshells be the next cybersecurity news breach?

Patching CVE-2026-110447 closes the door; it does not evict anyone already inside. Attackers routinely drop webshells for persistence before a patch lands. The hunt checklist below covers the telltales: unknown PHP files, modified timestamps, suspicious cron jobs, and outbound connections you cannot explain.

What is a webshell?

A small malicious script attackers leave on a compromised server, giving them remote control even after the original vulnerability is patched.

Here is the part most admins miss: updating the Collabora app to 26.4.303 closes the hole — but it does not delete web shells attackers already planted. A maintainer had to explicitly tell admins to go delete lingering malicious PHP files. Patching and hunting are two separate jobs. This free Nextcloud CVE checklist walks you through the hunt.

The persistence-hunt checklist

Tick each box as you complete it. Your verdict updates live. Defensive checks only — nothing here attacks anything.

0 of 5 checks complete

1. Hunted for planted shells — searched the Nextcloud app directory for PHP files you didn't install. Attackers used names like shx*.php / shrf*.php — and a live Nx_*.php backdoor was reported 2026-10-16. find /var/www/nextcloud/apps -name "shx*.php" -o -name "shrf*.php" -o -name "Nx_*.php" 2>/dev/null — any hit is an incident, not a cleanup task. 2. Reviewed access logs since Sept 10, 2026 — looked for requests to the built-in CODE server's proxy.php (especially proxy.php?status) and suspicious command-like request paths around any restart or upgrade window. Earliest logged attack: September 10, 2026. If you see hits, assume the window was used. 3. Confirmed the fix is real — the built-in CODE app is at 26.4.303 or higher, or fully removed. Disabling it does not count. sudo -u www-data php occ app:list | grep richdocumentscode 4. Rotated exposed secrets — if the server was reachable and vulnerable any time Sept–Oct 2026, every secret the web-server account could read (DB credentials, app passwords, API keys) is treated as exposed and rotated. Attackers searched compromised servers for KeePass databases, wallet.dat, and password-manager artifacts. 5. Treated any find as an incident — if step 1 or 2 turned up anything, you isolated the server and investigated instead of just deleting the file. Deleting a shell without understanding the intrusion leaves the attacker's other footholds in place.

NOT VERIFIED CLEAN. Work through the checklist above — each tick updates this verdict.

Why patching isn't enough

Sept 11, 2026: fix released in richdocumentscode 26.4.303 — but the CVE advisory didn't land until Oct 14, and exploitation was already happening in September.
Reporting on the incident is explicit: an update does not remove a shell already planted, so patching and checking for persistence are separate tasks.
On compromised servers, attackers searched for credential stores and crypto wallets (KeePass databases, wallet.dat). No root access was reported, and reviewed requests showed discovery rather than confirmed exfiltration — but anything readable by the web-server account should be treated as exposed.
Reports of ransomware operators exploiting the flaw are unconfirmed (BleepingComputer).

Sources: The Hacker News · SC Media · CyberPress · NeoTeo

Not sure you're exposed in the first place?

Run the 5-question self-assessment first, then come back here for the leftovers hunt.

Take the Nextcloud exposure quiz →

Also: the 30-second CVE-2026-110447 exposure check · audit what the attackers hunted

FROM INGENIOUS AI

Ingenious AI builds 11 AI security platforms — disclosure compliance, rogue-agent defense, breach hunting, agent oversight, and more.

All 11 platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI

Our platforms are being upgraded and return November 1 — get early access now:

Get early access on WhatsApp →

Does patching CVE-2026-110447 remove web shells attackers planted?

No. Updating the Collabora built-in CODE Server app to 26.4.303+ (or removing it) closes the vulnerability but does not delete web shells already planted. A project maintainer explicitly urged admins to also delete lingering shx-prefixed PHP files. Patching and compromise-hunting are two separate jobs.

What filenames did the Nextcloud web shells use?

Public incident reporting describes attackers planting PHP web shells with names matching shx*.php and shrf*.php inside the app directory, and on 2026-10-16 a community member reported a live backdoor named Nx_33143.php (containing a simple system() shell) found via the integrity check. Searching your Nextcloud app directories for unexpected PHP files matching these patterns is the first hunt step.

What logs should I check after patching CVE-2026-110447?

Review web-server access logs from September 10, 2026 onward for requests to the built-in CODE server's proxy.php endpoint (especially proxy.php?status) and any suspicious command-like request paths. The earliest logged attack dates to September 10, 2026.

Is Nextcloud safe?

Nextcloud itself remains safe to use when kept updated — the October 2026 incident was a critical flaw (CVE-2026-110447) in one optional app, the built-in Collabora CODE server, not in Nextcloud core. Stay on a supported release, apply maintenance updates promptly, and remove apps you do not use.

How do I check if my Nextcloud is vulnerable?

Check whether the ‘Collabora Online – Built-in CODE Server’ app (richdocumentscode) is installed and older than 26.4.303 — via Admin > Apps or ‘occ app:list’. If the app was present at any point in September–October 2026, assume exposure and hunt for web shells even after patching.

What should I do if my Nextcloud was hacked?

Take the server offline, restore from a clean backup or rebuild it, and rotate every credential the server touched. Hunt for leftover PHP web shells — patching CVE-2026-110447 does not remove shells attackers already planted — then update the Collabora app to 26.4.303+ or remove it.