TL;DR for HK self-hosters: If you run Nextcloud on a single VPS or an on-prem box, check whether the optional Collabora Online – Built-in CODE Server app is installed, and check it today. Attackers have been planting web shells on Nextcloud servers by going through that add-on, according to a report by The Hacker News. If you never installed the CODE app, you are not exposed to this particular attack path — but it is still worth confirming rather than assuming.
What happened
As reported by The Hacker News, attackers exploited a flaw in the optional Nextcloud app "Collabora Online – Built-in CODE Server" to plant web shells on Nextcloud servers. Three administrators have publicly reported compromises via GitHub, with the earliest logged attack dated 10 September. A web shell is a small file that lets an attacker issue arbitrary commands through a web request, executed with the privileges of the web server account — typically www-data or the equivalent nginx/php-fpm user. From there, an intruder can read and modify files, pivot to other services on the same host, or establish persistence.
The compromise is not theoretical: three independent administrators have described it, which is enough to treat this as an active, live threat rather than a lab finding.
An important editorial caveat on versions
We want to be straight with readers: no CVE identifier or affected-version range can be responsibly published here. The source material we worked from is truncated mid-sentence at the technical detail, and neither Nextcloud's nor Collabora's vendor advisory was available to us at time of writing. Rather than guess at version numbers — which in a security story is worse than useless, because it produces false reassurance — we are directing you to the authoritative sources instead:
- The Hacker News write-up: https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html
- GitHub's advisory database, which carries the three administrator reports: https://github.com/advisories
- Nextcloud's own security advisories and the Collabora CODE release notes for the patched build
Before you act on any version number you read anywhere, confirm it against those sources. When we have a verified affected/patched range, this piece will be updated and this caveat removed.
Why it matters here in Hong Kong
The following section is editorial background and general guidance from the HKLUG Team — it does not come from the cited report. Nothing in The Hacker News write-up specifically addresses Hong Kong deployments, PDPO obligations, or local deployment patterns; treat the points below as general context for operators here, not as facts drawn from the incident reporting.
A large number of local SMEs, schools, NGOs and one-person IT shops run Nextcloud on a single VPS or a NAS in a local data centre, often with a single administrator wearing every hat. That architecture means a web shell is not a contained incident — it is host compromise. It also means the data sitting behind it is very often personal data.
Under the Personal Data (Privacy) Ordinance (PDPO), organisations handling Hong Kong personal data have obligations around data security and, in practice, must be able to account for a breach. A web shell on a Nextcloud instance typically exposes user records, file shares, calendar and contact data, and — because Nextcloud integrations often hold app passwords — potentially the credentials of connected services. Data residency matters too: if your Nextcloud instance is your chosen on-shore or in-HK storage layer specifically to keep data close, an intrusion quietly defeats that decision. Assess the incident against your data breach notification and documentation obligations, and involve your DPO or the responsible partner early — not after you have finished cleanup.
This is general guidance only, not legal advice; consult your own DPO or privacy counsel on whether and how the PDPO's breach-handling expectations apply to your specific deployment.
Check-your-stack checklist
- Check whether the Collabora Online – Built-in CODE Server app is enabled. Visit Settings → Administration → Apps (or query
occ app:list). If it is not installed, you are not exposed to this attack path. - Update or disable. Apply the vendor-patched CODE build, or disable and remove the app if you do not need built-in office editing.
- Hunt for web shells. Look for unexpected
.phpfiles under your Nextcloud web root, recently modified files, and unfamiliar endpoints. Check web server access logs for POST requests to odd paths. - Check persistence. Review crontab (
crontab -lfor all users, plus/etc/cron.d), systemd user and system units, andauthorized_keysunder every account including your Nextcloud service account. - Rotate secrets. Nextcloud admin and user passwords, database credentials, SSL private keys, and any app passwords stored in Nextcloud.
- Rebuild, don't just clean. If you find a web shell, assume the host is owned. Restore from your pre-10 September backup onto fresh infrastructure rather than patching over a compromised box.
Check your stack tonight — the earliest confirmed attack is already over a month old.
香港自架服務用戶重點摘要： 如果你在單一 VPS 或本地伺服器上運行 Nextcloud，請立即檢查是否已安裝可選的 Collabora Online – Built-in CODE Server 應用程式。根據 The Hacker News 的報道，黑客正透過該附加元件在 Nextcloud 伺服器植入 web shell。如果你從未安裝 CODE 應用程式，便不會受此特定攻擊路徑影響——但仍值得確認，而非假設安全。
事件經過
據 The Hacker News 報道，黑客利用可選 Nextcloud 應用程式「Collabora Online – Built-in CODE Server」的漏洞，在 Nextcloud 伺服器植入 web shell。已有三名管理員透過 GitHub 公開報告遭入侵，最早一宗有記錄的攻擊日期為 9 月 10 日。Web shell 是一個小型檔案，讓攻擊者透過 web request 發出任意指令，並以 web server 帳戶的權限執行——通常是 www-data 或相應的 nginx/php-fpm 用戶。入侵者由此可以讀取及修改檔案、橫向移動至同一主機上的其他服務，或建立持久化後門。
今次入侵並非純屬理論風險：三名獨立管理員已分別描述遭遇，足以將此事視為正在發生的活躍威脅，而非僅是實驗室發現。
關於版本號的重要編輯說明
我們向讀者坦白交代：此處無法負責任地提供任何 CVE 編號或受影響版本範圍。 我們依據的原始資料在技術細節的句子中途截斷，而 Nextcloud 及 Collabora 的官方安全通告在撰稿時亦未能取得。與其猜測版本號碼——在安全新聞中這比毫無用處更糟，因為會造成虛假的安全感——我們建議讀者直接查閱以下權威來源：
- The Hacker News 的詳細報道：https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html
- GitHub 的 advisory database，收錄了三名管理員的報告：https://github.com/advisories
- Nextcloud 官方安全通告及 Collabora CODE 已修復版本的 release notes
在根據任何版本號碼採取行動之前，請先向上述來源核實。當我們取得經證實的受影響／已修復版本範圍後，本文將會更新並移除此說明。
為何香港用戶需特別留意
以下內容為 HKLUG Team 的編輯背景資料及一般性指引——並非引述自上述報道。The Hacker News 的文章並無特別提及香港的部署情況、PDPO 責任或本地部署模式；以下各點僅供本地用戶作一般背景參考，不應視為源自事件報道的事實。
大量本地中小企、學校、非牟利機構及一人 IT 公司，都在本地數據中心的單一 VPS 或 NAS 上運行 Nextcloud，往往只有一名管理員身兼數職。此架構下，web shell 並非一宗可控範圍內的事故，而是整台主機遭淪陷。同時，背後的數據通常正是個人數據。
根據**《個人資料（私隱）條例》（PDPO）**，處理香港個人資料的機構在資料保安方面負有責任，實際上必須能夠就資料外洩作出交代。Nextcloud 實例上的 web shell 通常會暴露用戶紀錄、檔案共享、日曆及聯絡人數據，而且——由於 Nextcloud 整合功能經常儲存 app passwords——有機會連帶洩露已連接服務的認證憑證。數據所在地同樣重要：如果你特意選擇 Nextcloud 作為本地或香港境內的儲存層以確保數據就近保存，一次入侵便會悄然令這個決定失效。請按照資料外洩通知及文件存檔方面的責任評估今次事件，並盡早聯繫你的 DPO 或負責合夥人——而非在完成清理工作之後才行動。
以上僅為一般指引，並非法律意見；如有疑問，請就 PDPO 的資料外洩處理規定如何適用於你的具體部署，諮詢你自己的 DPO 或私隱法律顧問。
技術架構檢查清單
- 檢查 Collabora Online – Built-in CODE Server 應用程式是否已啟用。 前往 Settings → Administration → Apps（或執行
occ app:list查詢）。如未安裝，你便不受此攻擊路徑影響。 - 更新或停用。 套用廠商已修復的 CODE 版本；若不需要內建文書編輯功能，則停用並移除該應用程式。
- 搜尋 web shell。 檢查 Nextcloud web root 下有無預期之外的
.php檔案、最近被修改的檔案，以及不熟悉的 endpoints。查閱 web server access log，留意對可疑路徑的 POST request。 - 檢查持久化機制。 審視 crontab（所有用戶執行
crontab -l，另加/etc/cron.d）、systemd 用戶及系統 units，以及所有帳戶（包括 Nextcloud 服務帳戶）下的authorized_keys。 - 更換所有機密。 Nextcloud 管理員及用戶密碼、數據庫認證資料、SSL private keys，以及儲存在 Nextcloud 中的任何 app passwords。
- 重建而非僅僅清理。 如發現 web shell，應假設主機已完全失陷。請從 9 月 10 日之前的備份還原至全新基礎設施，而非僅在已受入侵的主機上修補了事。
即時檢查你的部署——最早確認的攻擊已發生超過一個月。