Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
2026-10-16T01:23:22Z•28da56f48b740ad0dead87adc289517325073976b8ca0b67ab6f60ea5196e6b4
CVE-2026-0322CVE-2026-110447Arch Linux AURCisco Secure Email GatewayCollabora OnlineDPRK cyber operationsIoT compromiseNextcloudPAN-OSactive exploitationdata breachmalicious packagesproxyjackingremote code executionroot privilegessupply-chain attackvulnerability managementzero-day
What happened
A BleepingComputer security feed highlights active exploitation of multiple critical vulnerabilities, including Collabora Online CODE Server RCE (CVE-2026-110447), PAN-OS RCE (CVE-2026-0322), and an unauthenticated root-level command execution flaw in Cisco Secure Email Gateway. Other reported incidents include proxyjacking of D-Link and Ubiquiti devices, malicious Arch Linux AUR packages with root privileges, major data theft from the UK Legal Aid Agency, a Ledger supply-chain compromise, and DPRK remote IT worker activity.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 28da56f48b740ad0dead87adc289517325073976b8ca0b67ab6f60ea5196e6b4
- Enrichment time
- 2026-10-16T01:23:22Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.