CVE-2026-110447 — THE DISCLOSURE STORY
The 34-Day Nextcloud Disclosure Gap — Cybersecurity News Timeline
This cybersecurity news timeline reconstructs the 34-day gap between the first Nextcloud CVE-2026-110447 attack and public disclosure — September 10 to October 14, 2026.
What is the Nextcloud cybersecurity news disclosure gap?
The disclosure gap is the 34 days between the first observed Nextcloud CVE-2026-110447 attacks on September 10, 2026 and public disclosure on October 14. The fix shipped September 11, but the world heard nothing for over a month. This cybersecurity news timeline exists because nobody kept a public record of what happened in between — and admins deserve to see exactly when each milestone hit.
September 10: the first attack. September 11: the fix ships. October 14: the world finally hears about it. Nobody was keeping a public timeline of what happened in between — so we built this Nextcloud CVE timeline. Tap any milestone to expand it.
Interactive timeline
Tap a milestone for detail + source.
Sept 9, 2026
The fix is committed
Collabora commits the fix for the proxy.php command-injection flaw. Nothing public yet — no CVE number, no advisory, no forum post. (
cyber.hendryadrian.com)
Sept 10, 2026
First logged attack
Three administrators report attacks on GitHub. Logs from two servers show malicious requests on September 10 and 11 — the day
before the fixed release. Attackers plant PHP web shells and search one server for credential stores and crypto wallets. (
SC Media, via The Hacker News)
Sept 11, 2026
Fix released: richdocumentscode 26.4.303
The patched built-in CODE server app ships. Admins who update promptly are protected — but with no advisory and no CVE number, most have no reason to rush. The fixed release requires Nextcloud 30 or later. (
The Hacker News)
Oct 3, 2026
Community forum warning
A warning posted on the Nextcloud community forum (help.nextcloud.com) clarifies who is affected: installations using only the Nextcloud Office app without the built-in CODE app are not affected, whether Collabora runs in Docker, from a Linux package, or at a hosting provider. (
The Hacker News)
Oct 14, 2026
CVE-2026-110447 advisory published — 34 days later
Collabora publishes the formal security advisory with the CVE identifier, warning that disabling the app is insufficient — it must be updated to ≥26.4.303 or removed. The Hacker News posts its warning the same day. The GitHub Advisory Database entry notes this CVE differs from the earlier CVE-2025-66208 in the same script. (
THN ·
NeoTeo)
Oct 15, 2026
Collabora explains the delay
In a blog post, Collabora says GitHub's CVE-processing backlog grew from about a day to many weeks, and that it is applying to become a CVE Numbering Authority (CNA) so it can file CVEs directly. Separately, Nextcloud said it wanted administrators to have time to update and had not observed widespread exploitation — two different explanations for the same gap. (
NeoTeo, Oct 16)
Oct 16, 2026
Scale becomes visible
Censys publishes its advisory: CVE-2026-110447 is CVSS v4.0 9.2 (Critical), with 19,454 hosts and 103,350 web properties detected with the app installed. As of this date it is not in the CISA KEV catalog. (
Censys)
What admins should learn from the gap
1. Patch fast even without a CVE number. The fix shipped September 11 — a full month before the advisory. Admins waiting for a CVE feed to tell them what to do stayed exposed for 34 days.
2. Watch the forums, not just the feeds. The earliest public signals were GitHub reports from three admins and an Oct 3 community-forum post — not a CVE database.
3. Disabling ≠ fixing. The single most repeated mistake: disabling the built-in CODE app and assuming safety. Update to ≥26.4.303 or remove it.
4. An exposure window means an investigation. Patching closes the hole; it doesn't remove shells. If you were vulnerable any time in Sept–Oct 2026, hunt — don't just update.
FROM INGENIOUS AI
Ingenious AI builds 11 AI security platforms — disclosure compliance, rogue-agent defense, breach hunting, agent oversight, and more.
Our platforms are being upgraded and return November 1 — get early access now:
Get early access on WhatsApp →
Why did the CVE-2026-110447 advisory take 34 days after the first attack?
The fix shipped September 11, 2026, but the formal advisory wasn't published until October 14. Collabora's October 15 blog post attributes the delay to GitHub's CVE-processing backlog, which it says grew from about a day to many weeks; Collabora is applying to become a CVE Numbering Authority (CNA). Nextcloud separately said it wanted administrators to have time to update and that it had not observed widespread exploitation.
Was CVE-2026-110447 exploited before the advisory?
Yes. Three administrators reported attacks on GitHub, with the earliest logged attack on September 10, 2026 — over a month before the October 14 advisory. Attackers planted PHP web shells and searched servers for credential stores and crypto wallets.
What should admins learn from the disclosure gap?
Patch fast even without a CVE number — the fix shipped September 11, a full month before the advisory. Watch vendor forums and GitHub reports, not just CVE feeds. And remember that disabling the built-in CODE app does not fix it: update to 26.4.303+ or remove the app.
Is Nextcloud safe?
Nextcloud itself remains safe to use when kept updated — the October 2026 incident was a critical flaw (CVE-2026-110447) in one optional app, the built-in Collabora CODE server, not in Nextcloud core. Stay on a supported release, apply maintenance updates promptly, and remove apps you do not use.
How do I check if my Nextcloud is vulnerable?
Check whether the ‘Collabora Online – Built-in CODE Server’ app (richdocumentscode) is installed and older than 26.4.303 — via Admin > Apps or ‘occ app:list’. If the app was present at any point in September–October 2026, assume exposure and hunt for web shells even after patching.
What should I do if my Nextcloud was hacked?
Take the server offline, restore from a clean backup or rebuild it, and rotate every credential the server touched. Hunt for leftover PHP web shells — patching CVE-2026-110447 does not remove shells attackers already planted — then update the Collabora app to 26.4.303+ or remove it.