{"metadata": {"vulnerability": "cve-2026-110447", "count": 92, "kinds": {"milestone": 4, "sighting": 67, "kev": 11, "other": 10}}, "data": [{"timestamp": "2026-10-14T02:27:41.637Z", "date_only": false, "value": "2026-10-14T02:27:41.637Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-110447", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-110447", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "cve-2026-110447", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-110447", "field": "status.status_updated_at", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T02:40:18.583Z", "date_only": false, "value": "2026-10-14T02:40:18.583Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-110447", "field": "evidence.0.details.added_date", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T03:00:29.573Z", "date_only": false, "value": "2026-10-14T03:00:29.573165Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxskl4mgth23", "record": "cve-2026-110447", "field": "creation_timestamp", "uuid": "0c909fae-41b2-4a8b-bdf2-34bb66afe464", "content": "CRITICAL RCE (CVE-2026-110447) in Collabora Online Built-in CODE Server <26.4.303. Actively exploited since Sept 2026. Update to 26.4.303+ immediately. https://radar.offseq.com/threat/cve-2026-110447-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-f68ba52513af6...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxskl4mgth23"}, {"timestamp": "2026-10-14T03:00:32.017Z", "date_only": false, "value": "2026-10-14T03:00:32.017449Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117437027250345990", "record": "cve-2026-110447", "field": "creation_timestamp", "uuid": "96fb931f-de43-4b45-ab27-4090d04491b2", "content": "CVE-2026-110447 (CRITICAL, CVSS 9.2) allows RCE via OS command injection in Collabora Online Built-in CODE Server <26.4.303 (richdocumentscode, Nextcloud). Exploited in the wild since Sept 2026. Patch required. https://radar.offseq.com/threat/cve-2026-110447-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-f68ba52513af6028 #OffSeq #Infosec #Nextcloud #CVE2026110447", "url": "https://infosec.exchange/users/offseq/statuses/117437027250345990"}, {"timestamp": "2026-10-14T03:17:20Z", "date_only": false, "value": "2026-10-14T03:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F97P-R72Q-64H2", "record": "GHSA-F97P-R72Q-64H2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T03:17:20.683Z", "date_only": false, "value": "2026-10-14T03:17:20.683", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110447", "record": "FKIE_CVE-2026-110447", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-14T03:30:39Z", "date_only": false, "value": "2026-10-14T03:30:39Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F97P-R72Q-64H2", "record": "GHSA-F97P-R72Q-64H2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-14T03:37:35.973Z", "date_only": false, "value": "2026-10-14T03:37:35.973258Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxsmnhyvaj23", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "1db72b8d-2341-48b2-84e8-a116c7f5218f", "content": "Attackers are actively exploiting CVE-2026-110447 (CVSS 9.2), a critical Nextcloud Collabora Online RCE flaw in richdocumentscode, to deploy PHP webshells.\n\n#CVE2026110447 #Nextcloud #CollaboraOnline #RCE #Webshell #Cybersecurity #InfoSec #354", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxsmnhyvaj23"}, {"timestamp": "2026-10-14T03:53:14.706Z", "date_only": false, "value": "2026-10-14T03:53:14.706763Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hp62asx5qito6", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "4591732b-7cf8-4345-9ac7-1630e8583198", "content": "CVE-2026-110447 - Collabora Online CODE Server OS Command Injection Vulnerability\nCVE ID : CVE-2026-110447\n \n Published : Oct. 14, 2026, 3:17 a.m. | 15\u00a0minutes ago\n \n Description : Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allo...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/hp62asx5qito6"}, {"timestamp": "2026-10-14T04:07:43.364Z", "date_only": false, "value": "2026-10-14T04:07:43.364372Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxsode47y42z", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "5553a998-c767-4ecb-a137-e476c6cfaba9", "content": "\ud83d\udea8 CVE-2026-110447 \u2014 CVSS 9.2 CRITICAL\n\nCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote c...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110447\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxsode47y42z"}, {"timestamp": "2026-10-14T08:20:04.146Z", "date_only": false, "value": "2026-10-14T08:20:04.146457Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxt4gl7hiv2n", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "0dc17112-dedd-4d24-9aa5-dc21a7320cc2", "content": "CVE-2026-110447 - collabora online - built-in code server\nThe Collabora Online app for Nextcloud that includes the built\u2011in CODE server (versions before 26.4.303) can be tricked into running any command you choose\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#collabora #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxt4gl7hiv2n"}, {"timestamp": "2026-10-14T16:25:34.658Z", "date_only": false, "value": "2026-10-14T16:25:34.658953Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440193104567100", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "3d734c97-11d3-4571-8f83-dffa82bd05f1", "content": "CVE-2026-110447  Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110447https://github.com/CollaboraOnline/richdocumentscode/issues/354https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516#nextcloud #Collabora #CollaboraOnline-Built-inCODEServer#CVE_2026_110447#bot", "url": "https://infosec.exchange/users/cve/statuses/117440193104567100"}, {"timestamp": "2026-10-14T17:54:13Z", "date_only": false, "value": "2026-10-14T17:54:13.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10337", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "6577f1d5-3d85-44bf-85c0-5b4648b5e91a", "content": "\u203c\ufe0f Attackers planted PHP web shells on Nextcloud servers via Collabora's Built-in CODE app (CVE-2026-110447).\n\nCatch >> Disabling the app does NOT close the flaw. Exploitation requires its local document server to be down.\n\nUpdate to 26.4.303+ or remove it.\n\nRead: https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html", "url": "https://t.me/thehackernews/10337"}, {"timestamp": "2026-10-14T18:42:30.493Z", "date_only": false, "value": "2026-10-14T18:42:30.493692Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mxu77lfqiy25", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "9a7bb128-413e-462b-a1fb-d340250d9ce7", "content": "CVE-2026-110447 is trending. Hype score 5, currently #6 on cvemon.\n\nCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-110447", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mxu77lfqiy25"}, {"timestamp": "2026-10-14T20:33:16.802Z", "date_only": false, "value": "2026-10-14T20:33:16.802285Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117441167065150392", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "77290010-3da9-435e-a024-d739ae243ee5", "content": "Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora\u2019s Built-in CODE App\nAttackers have exploited a flaw in the Collabora Online built-in CODE app for Nextcloud to plant web shells on servers, The Hacker News reports. The unauthenticated command-execution flaw (CVE-2026-110447) can be triggered when the app\u2019s local document server is stopped, such as during a restart or upgrade; Collabora fixed it in September and warns that disabling the app is not enough \u2014 it must be updated or removed. https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html", "url": "https://infosec.exchange/users/edwardk/statuses/117441167065150392"}, {"timestamp": "2026-10-15T03:00:01Z", "date_only": false, "value": "2026-10-15T03:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-15T03:00:38.105Z", "date_only": false, "value": "2026-10-15T03:00:38.105594Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "d1f5568e-1ca4-4678-ab01-cb58c70d20ec", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-15T07:10:57Z", "date_only": false, "value": "2026-10-15T07:10:57.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/7c14e182-c75e-41da-81e6-e676c4a04de8", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "e157f565-f1db-4cf5-862a-430efee60554"}, {"timestamp": "2026-10-15T11:36:25.792Z", "date_only": false, "value": "2026-10-15T11:36:25.792805Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxvxulvdvi2r", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "da71a14c-7fae-44d7-a405-a472716291d6", "content": "Attackers exploited CVE-2026-110447 in the built-in Nextcloud CODE app to run commands and plant web shells when its local server was down. Collabora fixed versions before 26.4.303; users must update or remove the app.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxvxulvdvi2r"}, {"timestamp": "2026-10-15T12:05:07.186Z", "date_only": false, "value": "2026-10-15T12:05:07.186981Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxvzhwdlpq27", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "d1c841f0-6016-4fbb-9101-d44e07028bde", "content": "Vuln\u00e9rabilit\u00e9s critiques (CVSS \u2265 9) \u00b7 1\n\u2022 Collabora Online (Nextcloud) (CVE-2026-110447), CVSS 9.2 (Cyberveille Esant\u00e9)", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mxvzhwdlpq27"}, {"timestamp": "2026-10-15T12:55:28.822Z", "date_only": false, "value": "2026-10-15T12:55:28.822135Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yogsec.bsky.social/post/3mxw4bvwkj22d", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "324a5535-93db-4411-8174-2b930c4d55ab", "content": "CVE-2026-110447\n\nCollabora Online Built-in CODE Server before 26.4.303, a Nextcloud app, allows remote code execution. OS command injection in proxy.php when the CODE server is not running, such as after a restart.\n\nnvd.nist.gov/vuln/detail/...\n\n#CVE #CollaboraOnline #InfoSec #RemoteCodeExecution", "url": "https://bsky.app/profile/yogsec.bsky.social/post/3mxw4bvwkj22d"}, {"timestamp": "2026-10-15T20:25:23.161Z", "date_only": false, "value": "2026-10-15T20:25:23.161939Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mxwvghcpe627", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "edd2396f-b042-4bec-ba5a-d65bb9346611", "content": "Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mxwvghcpe627"}, {"timestamp": "2026-10-15T20:33:40.928Z", "date_only": false, "value": "2026-10-15T20:33:40.928164Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxwvvcdcc32w", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "8f877ccd-fc5a-4bb5-8b9b-a1767108d4d0", "content": "Hacker\u304cCollabora Online \u306eRCE\u8106\u5f31\u6027\u3092\u60aa\u7528\u3001Nextcloud\u30b5\u30fc\u30d0\u30fc\u306b\u30d0\u30c3\u30af\u30c9\u30a2\u3092\u8a2d\u7f6e\n\n\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u3001Nextcloud\u5411\u3051\u30a2\u30d7\u30ea\u300cCollabora Online - Built-in CODE Server\u300d\uff08richdocumentscode\uff09\u306b\u5b58\u5728\u3059\u308b\u6df1\u523b\u306a\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u306e\u8106\u5f31\u6027\u300cCVE-2026-110447\u300d\u3092\u60aa\u7528\u3057\u3066\u3044\u307e\u3059\u3002 \u8907\u6570\u306e\u7ba1\u7406\u8005\u304b\u3089\u306e\u5831\u544a\u306b\u3088\u308b\u3068\u3001\u653b\u6483\u306f9\u6708\u4e2d\u65ec\u306b\u59cb\u307e\u3063\u3066\u3044\u307e\u3057\u305f", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxwvvcdcc32w"}, {"timestamp": "2026-10-15T20:40:12Z", "date_only": false, "value": "2026-10-15T20:40:12.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/25814", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "5d36a2f6-db69-4de3-80e0-779a9cee1eb7", "content": "\u200aHackers exploit Collabora RCE flaw to backdoor Nextcloud servers\n\nThreat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/", "url": "https://t.me/BleepingComputer/25814", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-15T20:40:12Z", "date_only": false, "value": "2026-10-15T20:40:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/BleepingComputer/25814", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "95518350-2f43-42cd-938b-8a0accc01643", "content": "\u200aHackers exploit Collabora RCE flaw to backdoor Nextcloud servers\n\nThreat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/", "url": "https://t.me/BleepingComputer/25814"}, {"timestamp": "2026-10-15T21:00:04Z", "date_only": false, "value": "2026-10-15T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Km_CKVuM60per-Kt9cYcm4cRFPdByGiibWs2OtLSLbyjBgM", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "8b96276d-fe3a-42a7-ad1a-dcde7a0a8407", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-15T21:00:04Z", "date_only": false, "value": "2026-10-15T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Km_CKVuM60per-Kt9cYcm4cRFPdByGiibWs2OtLSLbyjBgM", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "8f98160e-1af7-47da-8b96-902ff77a41de"}, {"timestamp": "2026-10-15T21:23:48.684Z", "date_only": false, "value": "2026-10-15T21:23:48.684787Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxwyowsvy52t", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "32aed13f-2c66-4ee4-895b-97b4b1633d31", "content": "\ud83e\udd16 CVE-2026-110447: critical RCE in Collabora Online's CODE Server app (richdocumentscode) for Nextcloud, exploited in the wild to backdoor servers. Patch + audit for webshells.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-collaborarceflawtobackdoornextcloudservers/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxwyowsvy52t"}, {"timestamp": "2026-10-15T22:02:50.543Z", "date_only": false, "value": "2026-10-15T22:02:50.543106Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mxx2uq6ndl2r", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "1b46ac44-d917-4df2-a8eb-9781e6081b68", "content": "\ud83d\udd12 Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers\n\nThreat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora ...\n\nhttps://tinyurl.com/228aowq5 #CyberSecurity #InfoSec #CrustyTLDR", "url": "https://bsky.app/profile/crustytldr.bsky.social/post/3mxx2uq6ndl2r"}, {"timestamp": "2026-10-15T23:00:30Z", "date_only": false, "value": "2026-10-15T23:00:30.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44932", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "98079a49-2530-43be-9d3e-2fd15dd74a13", "content": "Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers\n\nThreat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/", "url": "https://t.me/VulnerabilityNews/44932", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-15T23:48:30.892Z", "date_only": false, "value": "2026-10-15T23:48:30.892187Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxxarnuy5s2n", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "145ba434-ac4e-4864-bb92-1a61c9e5d2bd", "content": "Attackers are exploiting CVE-2026-110447 in Nextcloud\u2019s optional built-in Collabora CODE app. Versions before 26.4.303 are affected; administrators should upgrade or remove the app. Some ransomware exploitation reports remain unconfirmed.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxxarnuy5s2n"}, {"timestamp": "2026-10-16T05:29:16.493Z", "date_only": false, "value": "2026-10-16T05:29:16.493560Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pickuma.bsky.social/post/3mxxtsygx3z2u", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "fdcc0f12-84b9-4f2a-92a8-3ec1b97de546", "content": "What the Collabora CODE flaw means for Nextcloud\n\nAttackers hit Nextcloud servers for a month before CVE-2026-110447 existed. Here is how to check if you run the vulnerable app and what to do.", "url": "https://bsky.app/profile/pickuma.bsky.social/post/3mxxtsygx3z2u"}, {"timestamp": "2026-10-16T05:33:10.216Z", "date_only": false, "value": "2026-10-16T05:33:10.216484Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxxtzy2sfj24", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "bd2b6309-9701-4dd9-940c-1239d4a1e89e", "content": "\ud83e\udd16 CVE-2026-110447: command injection in Nextcloud's Collabora \"Built-in CODE Server\" app, exploited since mid-Sept to drop webshells and steal creds. Fix: 26.4.303+\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxxtzy2sfj24"}, {"timestamp": "2026-10-16T05:56:29.608Z", "date_only": false, "value": "2026-10-16T05:56:29.608235Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mxxvdotjw52l", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "bc500aad-1471-49b2-95b9-0eaa35b098ee", "content": "\ud83d\udee1\ufe0f Revue cyber du 16 octobre :\n\n\u2022Collabora/Nextcloud : RCE CVE-2026-110447 exploit\u00e9e pour poser une backdoor.\n\u2022CERT-FR : Cisco AsyncOS CVE-2026-76519 exploit\u00e9 ; lot F5/Palo Alto/Juniper/Drupal.\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1325/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mxxvdotjw52l"}, {"timestamp": "2026-10-16T06:00:35.823Z", "date_only": false, "value": "2026-10-16T06:00:35.823909Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/it-connect.bsky.social/post/3mxxvky3q5g23", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "1bc905a9-1caa-4d15-a694-e122bc30ac77", "content": "#Nextcloud : une faille critique dans l'application #Collabora Built-in CODE (CVE-2026-110447) est exploit\u00e9e depuis le 10 septembre pour d\u00e9poser des webshells. D\u00e9sactiver l'application ne suffit pas. Comment vous prot\u00e9ger :\nwww.it-connect.fr/nextcloud-co...", "url": "https://bsky.app/profile/it-connect.bsky.social/post/3mxxvky3q5g23"}, {"timestamp": "2026-10-16T06:37:42Z", "date_only": false, "value": "2026-10-16T06:37:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/nextcloud-rilevato-sfruttamento-di-una-vulnerabilita-nel-componente-collabora-online-built-in-code-server", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "66e56890-4c3b-475a-a314-67e737623858", "url": "https://www.acn.gov.it/portale/w/nextcloud-rilevato-sfruttamento-di-una-vulnerabilita-nel-componente-collabora-online-built-in-code-server"}, {"timestamp": "2026-10-16T09:01:37.972Z", "date_only": false, "value": "2026-10-16T09:01:37.972583Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117449772079201201", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "f62d0e61-b669-43e4-9007-783ac6fdf7c4", "content": "Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers\nThreat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447, in the Collabora Online Built-in CODE Server app for Nextcloud. BleepingComputer reports the flaw is being used to backdoor Nextcloud servers. https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/", "url": "https://infosec.exchange/users/edwardk/statuses/117449772079201201"}, {"timestamp": "2026-10-16T09:01:39.087Z", "date_only": false, "value": "2026-10-16T09:01:39.087159Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxy7ora27u27", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "d18863a9-bc88-4596-8406-7228d18437d1", "content": "Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers\n\nThreat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447, in the Collabora Online Built-in CODE Server app for Nextcloud. BleepingComputer reports the flaw is being used to backdoor Nextcloud servers.", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxy7ora27u27"}, {"timestamp": "2026-10-16T14:29:00.752Z", "date_only": false, "value": "2026-10-16T14:29:00.752061Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/censys.bsky.social/post/3mxyry4m75p25", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "e20cc63a-a869-4bfd-acd3-357d9563def7", "content": "\ud83d\udea8 Rapid Response: CVE-2026-110447 (CVSS 9.2), a critical flaw in the Collabora Online Built-in CODE Server for Nextcloud, has reportedly been exploited in the wild.\n\nCensys detects 19,454 hosts and 103,350 web properties with the app installed, not all confirmed vulnerable. https://bit.ly/4BbTBrm ", "url": "https://bsky.app/profile/censys.bsky.social/post/3mxyry4m75p25"}, {"timestamp": "2026-10-16T18:15:03.631Z", "date_only": false, "value": "2026-10-16T18:15:03.631151Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxz6mcnzis2l", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "f3aac05a-9a29-4f14-9f3d-24f01aff9ae8", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-99999 \u00b7 43 people\n2. CVE-2026-102764 \u00b7 27 people \ud83d\udd25\n3. CVE-2026-0322 \u00b7 13 people \ud83d\udd25\n4. CVE-2026-76519 \u00b7 11 people \ud83d\udd25\n5. CVE-2026-110447 \u00b7 10 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxz6mcnzis2l"}, {"timestamp": "2026-10-16T18:15:06.085Z", "date_only": false, "value": "2026-10-16T18:15:06.085773Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxz6md2a4s2l", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "3a19268f-e420-4351-b721-b0701f88d60e", "content": "5. CVE-2026-110447 \u00b7 10 people\n\ud83d\udfe5 Critical 9.2 \u00b7 Collabora Online - Built-in CODE Server\n\nCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than\u2026", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxz6md2a4s2l"}, {"timestamp": "2026-10-16T21:20:56.814Z", "date_only": false, "value": "2026-10-16T21:20:56.814852Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mxziynnpxs24", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "053c6636-04c3-4c1a-931a-f1bc80e99d2e", "content": "Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers\n\nThreat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mxziynnpxs24"}, {"timestamp": "2026-10-17T05:31:15.303Z", "date_only": false, "value": "2026-10-17T05:31:15.303298Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3my2efhd3di2q", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "02ef1057-52c2-4cc5-9b5e-d40632cc32c2", "content": "Kritieke kwetsbaarheid in Nextcloud's Collabora-integratie maakt ongeautoriseerd\n\nEen ernstige kwetsbaarheid, CVE-2026-110447, is ontdekt in de Collabora Online Built-in CODE Server app voor Nextcloud, waardoor externe aanvallers zonder authenticatie besturingssysteemcommando's kunnen uitvoe...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3my2efhd3di2q"}, {"timestamp": "2026-10-17T05:33:37.705Z", "date_only": false, "value": "2026-10-17T05:33:37.705176Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3my2ejp7tgc2n", "record": "cve-2026-110447", "field": "creation_timestamp", "uuid": "435c0a80-e67a-4681-86f9-610a970a5ecb", "content": "Hackers Exploit CVE-2026-110447 to Backdoor Nextcloud Servers\n\nhttps://cyberupdates365.com/cve-2026-110447-nextcloud-collabora-rce/\n\n#CyberSecurity", "url": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3my2ejp7tgc2n"}, {"timestamp": "2026-10-17T09:26:23.015Z", "date_only": false, "value": "2026-10-17T09:26:23.015447Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3my2rjvudyz2g", "record": "cve-2026-110447", "field": "creation_timestamp", "uuid": "b96b2764-1f30-4a20-82ec-7ee8d175ef66", "content": "Critical Nextcloud Collabora Flaw Enables Unauthenticated Command Execution Through Built-in CODE\u00a0Server\n\nCVE-2026-110447 is a critical Nextcloud Collabora RCE flaw exploited in the wild. Learn affected versions, attack\u2026\n\nhttps://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/", "url": "https://bsky.app/profile/thecybersecguru.com/post/3my2rjvudyz2g"}, {"timestamp": "2026-10-18T10:15:20Z", "date_only": false, "value": "2026-10-18T10:15:20.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cyberbannews_ir/24170", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "66e9b02b-c8e3-4661-a19e-bec5fc2020f4", "content": "\u2666\ufe0f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0647\u06a9\u0631\u0647\u0627 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc Nextcloud\n\n\ud83d\udd3a \u0647\u06a9\u0631\u0647\u0627 \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \"CVE-2026-110447\" \u062f\u0631 \u0627\u0641\u0632\u0648\u0646\u0647 \u0633\u0631\u0648\u0631 \u062f\u0627\u062e\u0644\u06cc Collabora \u0628\u0631\u0627\u06cc Nextcloud\u060c \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0641\u0631\u0645\u0627\u0646 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062f\u0631 \u0628\u0631\u062e\u06cc \u0633\u0631\u0648\u0631\u0647\u0627 \u0648\u0628\u200c\u0634\u0644 \u0646\u0635\u0628 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\n\n\ud83d\udd3b \u0645\u062f\u06cc\u0631\u0627\u0646 \u0628\u0627\u06cc\u062f \u0627\u0641\u0632\u0648\u0646\u0647 \"richdocumentscode\" \u0631\u0627 \u0628\u0647 \u0646\u0633\u062e\u0647 \"26.4.303\" \u06cc\u0627 \u062c\u062f\u06cc\u062f\u062a\u0631 \u0627\u0631\u062a\u0642\u0627 \u062f\u0647\u0646\u062f\u061b \u063a\u06cc\u0631\u0641\u0639\u0627\u0644\u200c\u06a9\u0631\u062f\u0646 \u0622\u0646 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a.\n\n#\u0627\u0645\u0646\u06cc\u062a_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc\n\n\ud83d\udcc4\ud83d\udd0d @cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/24170", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-19T08:00:51Z", "date_only": false, "value": "2026-10-19T08:00:51.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/kasperskyb2b/2346", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "a0d513c9-8a6b-4ea5-9e17-3caa28da5b25", "content": "\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f APT \u0438 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u0418\u0411 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e\n\n\ud83d\udc40 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 PEERSTITCH \u2014 \u0431\u0435\u0441\u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0433\u043e \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430 \u0434\u043b\u044f FortiGate, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0433\u0440\u0443\u043f\u043f\u0430 CL-STA-0954/UNC5820 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0430 \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 FortiManager \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0441\u0435\u0440\u0432\u0438\u0441-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 (MSP). \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043b\u0438 FortiJump (CVE-2024-47575) \u0438 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0441\u0447\u0451\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u043a\u043b\u044e\u0447\u0430\u043c \u0434\u043b\u044f 500 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u043c \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u043e\u0432. \u0418\u043c\u043f\u043b\u0430\u043d\u0442 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b FortiOS \u0438 \u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0441\u0432\u043e\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u0443\u0436\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043d\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044f \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u043e\u0440\u0442\u043e\u0432.\n\n\ud83d\udd0e \u041e\u0431\u0437\u043e\u0440 TTPs \u0433\u0440\u0443\u043f\u043f\u044b Silent Lynx/UAT-6275/TAG-193, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u043b\u0430 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0432\u043e\u0441\u0435\u043c\u044c \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u0440\u043e\u0442\u0438\u0432 \u0433\u043e\u0441\u043e\u0440\u0433\u0430\u043d\u043e\u0432 \u0432 \u0434\u0435\u0432\u044f\u0442\u0438 \u0441\u0442\u0440\u0430\u043d\u0430\u0445 \u0421\u041d\u0413, \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0438\u0432\u0448\u0438\u0441\u044c \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0432 \u0441\u0444\u0435\u0440\u0435 \u0434\u0438\u043f\u043b\u043e\u043c\u0430\u0442\u0438\u0438, \u043f\u0440\u0438\u0440\u043e\u0434\u043e\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f, \u0432\u043e\u0434\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0438 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0438. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0430\u043d\u043e\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b Word \u0441 \u043c\u0430\u043a\u0440\u043e\u0441\u0430\u043c\u0438 \u0438 \u0430\u0440\u0445\u0438\u0432\u044b WinRAR, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 CVE-2025-8088, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u043b\u0438\u0441\u044c \u043d\u0430 GitHub. \u0410\u0432\u0442\u043e\u0440\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u0433\u0440\u0443\u043f\u043f\u0430 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0443 \u0443\u0433\u0440\u043e\u0437, \u0447\u0442\u043e \u0438 Tomiris/Storm-0473.\n\n\ud83d\ude2e \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434 \u00ab\u044d\u0444\u0435\u043c\u0435\u0440\u043d\u043e\u0439\u00bb \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a. \u0413\u0440\u0443\u043f\u043f\u0430 UNC7017 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u041f\u041e AOMEI Backupper, \u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u043b\u0430 \u0438\u0445 \u043d\u0430 \u0440\u0430\u0437\u0434\u0430\u0447\u0443 \u0412\u041f\u041e \u043b\u0438\u0448\u044c \u043a\u0440\u0430\u0442\u043a\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0440\u0438 \u043e\u043a\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0437\u0430 \u0434\u0432\u0430 \u043c\u0435\u0441\u044f\u0446\u0430, \u043a\u0430\u0436\u0434\u043e\u0435 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0441\u0435\u0433\u043e 5-10 \u043c\u0438\u043d\u0443\u0442. \u0421 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u043e\u0441\u044c \u0412\u041f\u041e CROSSROAD \u0434\u043b\u044f \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0436\u0435\u0440\u0442\u0432\u044b \u0438 \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440 SHINYROAD \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u043c\u0438\u0448\u0435\u043d\u0435\u0439.\n\n\ud83c\udf10 \u0420\u0430\u0437\u0431\u043e\u0440 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0439 \u0430\u0442\u0430\u043a\u0438 UTA0576, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 0day \u0432 Ivanti Connect Secure \u043f\u0440\u043e\u0442\u0438\u0432 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041d\u0435 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u044f \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0438\u0437\u0432\u043b\u0435\u043a\u043b\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043f\u0430\u0440\u043e\u043b\u0438 LAPS \u0438 \u043a\u043b\u044e\u0447\u0438 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f BitLocker. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044d\u0442\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430. \n\n\ud83d\udfe0\u041e\u0431\u0437\u043e\u0440 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0438 TTPs \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Insolent Hyena, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043e \u0438\u0442\u043e\u0433\u0430\u043c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0435\u0440\u0435\u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432 \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0443\u044e. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043d\u043e\u0432\u043e\u0435 \u0412\u041f\u041e NightStrike, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u043e\u0432 AdaptixC2, Cobalt Strike \u0438 Havoc.\n\n\ud83d\udcbb \u0410\u043d\u0430\u043b\u0438\u0437 TTPs \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 MicrosoftSystem64 RAT, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0447\u0435\u0440\u0435\u0437 88 GitHub-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0430 \u0442\u0435\u043c\u044b AI-\u0430\u0433\u0435\u043d\u0442\u043e\u0432 \u0438 \u0442\u0440\u0435\u0439\u0434\u0438\u043d\u0433\u0430, \u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 npm-\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0433\u043e \u041f\u041e. \u041a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u0430\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0444\u043e\u0440\u043a\u0438 \u0434\u0435\u043b\u0430\u044e\u0442 \u0442\u0430\u043a\u0438\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u043c\u0438 \u043d\u0430 \u0432\u0438\u0434, \u0430 \u043e\u0434\u0438\u043d \u0438\u0437 \u043d\u0438\u0445 \u0434\u0430\u0436\u0435 \u0432\u0441\u043f\u043b\u044b\u043b \u0431\u0435\u0437 \u044f\u0432\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0432 ChatGPT \u0438 Google AI Overview. \n\n\ud83d\udc6e\u200d\u2640\ufe0f \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u043b \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 143 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 34 \u0441\u0442\u0440\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f D-Link NAS, Ubiquiti NVR \u0438, \u0447\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435, \u0441\u0435\u0440\u0432\u0435\u0440\u044b SAP NetWeaver, \u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0442\u0438\u043b \u0438\u0445 \u0432 \u0443\u0437\u043b\u044b \u0441\u0435\u0442\u0438 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0445 \u043f\u0440\u043e\u043a\u0441\u0438 IPRoyal. \n\n\ud83d\udcf1 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u043d\u043e\u0432\u043e\u0433\u043e Android-\u0431\u0430\u043d\u043a\u0435\u0440\u0430 Hirudo, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0441\u0435\u043c\u0438 \u0438\u043d\u0434\u043e\u043d\u0435\u0437\u0438\u0439\u0441\u043a\u0438\u0445 \u0431\u0430\u043d\u043a\u043e\u0432 \u0438\u0445 \u0442\u0440\u043e\u044f\u043d\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u043a\u043e\u043f\u0438\u044f\u043c\u0438, \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u043c\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, Accessibility \u0438 Play Integrity. \u041e\u043d \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0448\u043e\u043f\u0438\u043d\u0433\u0430 \u0438 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0445 \u0432\u0438\u0434\u0435\u043e. \u0410\u043d\u0430\u043b\u0438\u0437 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0412\u041f\u041e \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043e \u043d\u0430 \u043a\u0440\u0430\u0436\u0443 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u041a\u0438\u0442\u0430\u0435, \u0418\u043d\u0434\u0438\u0438, \u041c\u0435\u043a\u0441\u0438\u043a\u0435, \u041c\u0430\u0440\u043e\u043a\u043a\u043e \u0438 \u0422\u0430\u0438\u043b\u0430\u043d\u0434\u0435. \n\n\ud83d\udfe1 \u0420\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0441\u0442\u0438\u043b\u0435\u0440\u0430 Aoki. \u0415\u0433\u043e \u043d\u043e\u0432\u044b\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u043a\u0440\u0430\u0434\u0443\u0442 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0441\u0435\u0441\u0441\u0438\u0438 \u0418\u0418-\u0430\u0433\u0435\u043d\u0442\u043e\u0432 Claude, Codex, Cursor, GitHub Copilot \u0438 Kiro. \u041f\u043e\u0445\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438 \u0442\u043e\u043a\u0435\u043d\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c. \n\n\ud83c\udf4f \u0410\u043d\u0430\u043b\u0438\u0437 Divine Seagull \u2014 \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442-\u043a\u0438\u0442\u0430 \u0434\u043b\u044f iOS, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u043e\u0434\u0430\u0451\u0442\u0441\u044f \u043a\u0438\u0442\u0430\u0435\u044f\u0437\u044b\u0447\u043d\u044b\u043c \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0441\u0445\u0435\u043c. \u0412 \u044d\u0442\u043e\u043c \u043d\u0430\u0431\u043e\u0440\u0435 \u0437\u0430\u043d\u043e\u0432\u043e \u0443\u043f\u0430\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 Coruna \u0438 DarkSword, \u043e\u043d \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u043f\u043b\u043e\u0442\u044c \u0434\u043e iOS 26.1. \u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e WebKit-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043e.\n\n\u2328\ufe0f\u041a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 45 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u0432 \u0440\u0435\u0434\u0430\u043a\u0446\u0438\u0438 Al Jazeera \u0441\u0442\u0430\u043b\u0438 \u0446\u0435\u043b\u044c\u044e \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0433\u043e \u041f\u041e Candiru/Integrity Labs. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u0435\u043d \u0441\u043f\u043e\u0441\u043e\u0431 \u0438\u043d\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u2014 \u044d\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u0430\u044f \u0440\u0435\u043a\u043b\u0430\u043c\u0430 \u043d\u0430 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043e\u043d\u043b\u0430\u0439\u043d-\u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0430\u0445. \u0414\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u0412\u041f\u041e \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0443\u0436\u043d\u044b\u043c \u043c\u0438\u0448\u0435\u043d\u044f\u043c \u043f\u043e\u043c\u043e\u0433\u043b\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Discover-Tech, \u0444\u0438\u043b\u044c\u0442\u0440\u0443\u044e\u0449\u0430\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u043c\u0438\u0448\u0435\u043d\u0438 \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u0432 \u0440\u0435\u043a\u043b\u0430\u043c\u043d\u044b\u0445 \u0430\u0443\u043a\u0446\u0438\u043e\u043d\u0430\u0445. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u044d\u0442\u0443 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 AdFection.\n\n\u2757\ufe0f Cisco \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f CVE-2026-76519, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Secure Email Gateway, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u043f\u0438\u0441\u044c\u043c\u043e \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0435\u043f\u0443\u0442\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\ud83d\udfe2\u041d\u0435 \u043e\u0442\u0441\u0442\u0430\u0451\u0442 \u0438 Palo Alto Networks \u2014 CVE-2026-0322 \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f PAN-OS \u0434\u0430\u0451\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0430\u043c PA-Series, VM-Series \u0438 Panorama. \u0423\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \n\n\ud83e\udeb2 \u041a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 10 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 CVE-2026-110447 \u2014 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 Collabora Online Built-in CODE Server \u0434\u043b\u044f Nextcloud. \u041f\u043e\u0441\u043b\u0435 \u0430\u0442\u0430\u043a\u0438 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u044e\u0442 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u043d\u0430 PHP, \u0438\u0449\u0443\u0442 \u0431\u0430\u0437\u044b \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438.\n\n\ud83d\udfe0PoC \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c AnyPwn \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u0443\u0447\u0438 \u0432 AnyDesk \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root \u0432 Linux \u0447\u0435\u0440\u0435\u0437 TCP-\u043f\u043e\u0440\u0442 7070 \u0435\u0449\u0451 \u0434\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u041e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c\u0441\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 8.0.3.\n\n\u2699\ufe0f \u0412 \u043d\u043e\u0447\u044c \u043d\u0430 11 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0435\u0440\u0435\u0432\u0435\u043b\u0438 \u0441\u043e\u0442\u043d\u0438 \u0445\u043e\u043b\u043e\u0434\u0438\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0432\u043e \u0444\u0440\u0430\u043d\u0446\u0443\u0437\u0441\u043a\u0438\u0445 \u0441\u0443\u043f\u0435\u0440\u043c\u0430\u0440\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Intermarch\u00e9 \u0438 Super U, \u0432 \u0440\u0435\u0436\u0438\u043c \u0440\u0430\u0437\u043c\u043e\u0440\u043e\u0437\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u044b Danfoss, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043f\u043e\u0440\u0447\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c \u0432\u043e\u0437\u0433\u043e\u0440\u0430\u043d\u0438\u044f\u043c. \u0412 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u0442\u0440\u0451\u0445 \u0434\u043d\u0435\u0439 \u0447\u0438\u0441\u043b\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 Danfoss StoreView \u0432\u043e \u0424\u0440\u0430\u043d\u0446\u0438\u0438 \u0441\u043e\u043a\u0440\u0430\u0442\u0438\u043b\u043e\u0441\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 70%.\n\n#\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 #APT @\u041f2\u0422", "url": "https://t.me/kasperskyb2b/2346"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-110447", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "1e6b8452-5a41-4e7a-801d-21a4de850a78", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": true, "value": "2026-10-23", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-110447", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": true, "value": "2026-10-23", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-110447", "field": "evidence.0.details.date_added", "uuid": "1e6b8452-5a41-4e7a-801d-21a4de850a78", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-110447", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "1e6b8452-5a41-4e7a-801d-21a4de850a78", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-110447", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110447", "record": "FKIE_CVE-2026-110447", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-110447", "field": "status.status_updated_at", "uuid": "1e6b8452-5a41-4e7a-801d-21a4de850a78", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-110447", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-10-23T20:00:02Z", "date_only": false, "value": "2026-10-23T20:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-110447", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "1e6b8452-5a41-4e7a-801d-21a4de850a78", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-23T20:00:02.616Z", "date_only": false, "value": "2026-10-23T20:00:02.616412Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1e6b8452-5a41-4e7a-801d-21a4de850a78", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "01f84134-8013-459c-b583-22ffe8273cf4", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1e6b8452-5a41-4e7a-801d-21a4de850a78", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-23T23:00:55Z", "date_only": false, "value": "2026-10-23T23:00:55.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/45083", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "8f822c8f-a691-4f06-b74b-a1ae6c9f1e84", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\n\nCISA has added one new vulnerability to its\u00a0Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-110447 Collabora Online \u2013 Built-in CODE Server OS Command Injection Vulnerability\u00a0\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of\u00a0KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the\u00a0specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s\u00a0KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0", "url": "https://t.me/VulnerabilityNews/45083", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-23T23:00:55Z", "date_only": false, "value": "2026-10-23T23:00:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/45083", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "680e9797-a401-482f-b52e-495bd281830c", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\n\nCISA has added one new vulnerability to its\u00a0Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-110447 Collabora Online \u2013 Built-in CODE Server OS Command Injection Vulnerability\u00a0\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of\u00a0KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the\u00a0specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s\u00a0KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0", "url": "https://t.me/VulnerabilityNews/45083"}, {"timestamp": "2026-10-24T03:55:50.462Z", "date_only": false, "value": "2026-10-24T03:55:50.462Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-110447", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-24T03:55:50.462Z", "date_only": false, "value": "2026-10-24T03:55:50.462Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-110447", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-24T04:25:57Z", "date_only": false, "value": "2026-10-24T04:25:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "a25df991-9a1f-440d-96d6-53fe6029848f", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.\n\nThe critical-severity vulnerabilities are listed below -\n\n\n  CVE-2026-110447 (CVSS score: 9.2) - An operating", "url": "https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html"}, {"timestamp": "2026-10-24T06:59:26Z", "date_only": false, "value": "2026-10-24T06:59:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/10/24/cisa-flags-two-actively-exploited.html", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "510adc36-0e2c-42b0-93e5-1b12ec845561", "content": "CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation in the wild, The Hacker News reports. The flaws are CVE-2026-110447 (CVSS 9.2) in Collabora Online’s Built-in CODE Server and a SQL injection flaw in Arista’s VeloCloud Orchestrator.", "url": "https://threatintel.cc/2026/10/24/cisa-flags-two-actively-exploited.html"}, {"timestamp": "2026-10-24T08:59:43.545Z", "date_only": false, "value": "2026-10-24T08:59:43.545557Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117495063057939326", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "24a1d75d-c0d5-4af6-9ef7-5920db66eeb4", "content": "CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation in the wild, The Hacker News reports. The flaws are CVE-2026-110447 (CVSS 9.2) in Collabora Online\u2019s Built-in CODE Server and a SQL injection flaw in Arista\u2019s VeloCloud Orchestrator. https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html", "url": "https://infosec.exchange/users/edwardk/statuses/117495063057939326"}, {"timestamp": "2026-10-24T19:14:53.978Z", "date_only": false, "value": "2026-10-24T19:14:53.978286Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-b3ee024d-0738d4fedbd35e04", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "744e9c46-3f7e-435d-885d-7d86e2be9d09", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online \u2013 Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. Collabora Online \u2013 Built-in CODE Server is [\u2026]U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog", "url": "https://poliverso.org/objects/0477a01e-b3ee024d-0738d4fedbd35e04"}, {"timestamp": "2026-10-24T23:45:43.824Z", "date_only": false, "value": "2026-10-24T23:45:43.824804Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ebansu.bsky.social/post/3mynusydcft2y", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "990245f0-de40-48aa-806f-519588ff7f61", "content": "Collabora Online\u306eBuilt-in CODE Server\u306bOS\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-110447\uff09\u304c\u5831\u544a\u3055\u308c\u307e\u3057\u305f\u3002\u7c73CISA\u306f\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3068\u3057\u3066\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u3001\u65e9\u6025\u306a\u5bfe\u51e6\u3092\u6c42\u3081\u3066\u3044\u307e\u3059\u3002\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110447", "url": "https://bsky.app/profile/ebansu.bsky.social/post/3mynusydcft2y"}, {"timestamp": "2026-10-25T01:39:08.850Z", "date_only": false, "value": "2026-10-25T01:39:08.850476Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3myo35sdvaw26", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "0114e4ac-c2c3-485f-af40-76705a516dab", "content": "\ud83e\udd16 CISA KEV: CVE-2026-110447 (9.2) command injection in Collabora CODE Server on Nextcloud, exploited to drop web shells. CVE-2026-114625 (9.9) SQLi in Arista VeloCloud Orchestrator, also exploited in the wild.\nhttps://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3myo35sdvaw26"}, {"timestamp": "2026-10-25T03:12:35Z", "date_only": false, "value": "2026-10-25T03:12:35.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/45091", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "88bab96d-e9a0-4642-9f89-d2180e0f2297", "content": "CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.\n\nThe critical-severity vulnerabilities are listed below -\n\n\n  CVE-2026-110447 (CVSS score: 9.2) - An operating\nhttps://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html", "url": "https://t.me/VulnerabilityNews/45091", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-25T08:19:17.232Z", "date_only": false, "value": "2026-10-25T08:19:17.232089Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3myorff2y222r", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "3c1277a0-c4e3-4516-9584-e3b3752fb587", "content": "[1/2] Nextcloud: CVE-2026-110447 in Collabora Built-in CODE Server (richdocumentscode < 26.4.303). Command injection non autenticata via proxy.php, con CODE server fermo (restart, upgrade, crash). Attacchi segnalati dal 10/09, web shell PHP. #infosec", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3myorff2y222r"}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": true, "value": "2026-10-26", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-110447", "field": "evidence.0.details.due_date", "uuid": "1e6b8452-5a41-4e7a-801d-21a4de850a78", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-26T01:55:04.503Z", "date_only": false, "value": "2026-10-26T01:55:04.503385Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/forsmile.jp/post/3myqmj5pz5k24", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "01b89e18-678a-4950-831e-3ba2eb64cddc", "content": "\u3010\u7dca\u6025\u3011Nextcloud\u300cCollabora Online - Built-in CODE Server\u300d\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\uff08CVE-2026-110447 / CVSS 9.2\uff09\n\n\u8a8d\u8a3c\u306a\u3057\u3067OS\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3055\u308c\u3001\u60aa\u7528\u3082\u78ba\u8a8d\u6e08\u307f\u3002\n\u5bfe\u51e6: 26.4.303\u4ee5\u4e0a\u3078\u66f4\u65b0\u3059\u308b\u304b\u524a\u9664\uff08\u7121\u52b9\u5316\u3067\u306f\u9632\u3052\u307e\u305b\u3093\uff09\u3002\n\nforsmile.jp/articles/col...\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #CVE", "url": "https://bsky.app/profile/forsmile.jp/post/3myqmj5pz5k24"}, {"timestamp": "2026-10-26T13:06:13.956Z", "date_only": false, "value": "2026-10-26T13:06:13.956280Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3myrrzcdtof2i", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "cacdb64f-a190-49d8-bb3e-8f17ecf0cec3", "content": "CISA Cracks Down on Nextcloud: Three Days to Close CVE-2026-110447", "url": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3myrrzcdtof2i"}, {"timestamp": "2026-10-26T14:05:15.697Z", "date_only": false, "value": "2026-10-26T14:05:15.697908Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3myrvcudiqs2h", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "0b8dd675-418e-43ef-a9d1-409b4cf3161f", "content": "Pillola di detection #1: Nextcloud/Collabora, CVE-2026-110447. Log web: richieste a /apps/richdocumentscode/proxy.php con %2e%2e, $( o ${IFS}. Disco: shx*.php nell'app. Sigma da testare. wz-it.com/en/blog/next...", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3myrvcudiqs2h"}, {"timestamp": "2026-10-26T18:32:45Z", "date_only": false, "value": "2026-10-26T18:32:45Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F97P-R72Q-64H2", "record": "GHSA-F97P-R72Q-64H2", "field": "modified"}, {"timestamp": "2026-10-27T17:44:28.235Z", "date_only": false, "value": "2026-10-27T17:44:28.235723Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3myurzqplzc2v", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "76cbc192-ec26-4abe-bbe6-46273883b87b", "content": "2) Nextcloud + Collabora built-in CODE server app (CVE-2026-110447): unauthenticated command injection, attacked since Sep 10. Upgrade richdocumentscode to 26.4.303+ or remove it; disabling isn't enough.\n\n3) Plex2Shell: Plex says widely exploited. Update to 1.43.3.10861+ and check for compromise.", "url": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3myurzqplzc2v"}, {"timestamp": "2026-10-27T17:44:29.129Z", "date_only": false, "value": "2026-10-27T17:44:29.129860Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3myurzqq5ls2v", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "08300eb0-28a0-4b45-ac50-8260c1486a82", "content": "2) Nextcloud + Collabora built-in CODE server app (CVE-2026-110447): unauthenticated command injection, attacked since Sep 10. Upgrade richdocumentscode to 26.4.303+ or remove it; disabling isn't enough.\n\n3) Plex2Shell: Plex says widely exploited. Update to 1.43.3.10861+ and check for compromise.", "url": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3myurzqq5ls2v"}, {"timestamp": "2026-10-27T17:44:30.016Z", "date_only": false, "value": "2026-10-27T17:44:30.016461Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3myurzqq6l22v", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "6f4a46af-9364-45bd-976f-bc5131a07f66", "content": "2) Nextcloud + Collabora built-in CODE server app (CVE-2026-110447): unauthenticated command injection, attacked since Sep 10. Upgrade richdocumentscode to 26.4.303+ or remove it; disabling isn't enough.\n\n3) Plex2Shell: Plex says widely exploited. Update to 1.43.3.10861+ and check for compromise.", "url": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3myurzqq6l22v"}, {"timestamp": "2026-10-27T17:44:30.915Z", "date_only": false, "value": "2026-10-27T17:44:30.915564Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3myurzqq7kc2v", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "4685915b-0c47-4d7a-bed7-f9c9b4f99d34", "content": "2) Nextcloud + Collabora built-in CODE server app (CVE-2026-110447): unauthenticated command injection, attacked since Sep 10. Upgrade richdocumentscode to 26.4.303+ or remove it; disabling isn't enough.\n\n3) Plex2Shell: Plex says widely exploited. Update to 1.43.3.10861+ and check for compromise.", "url": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3myurzqq7kc2v"}, {"timestamp": "2026-10-27T20:14:39.256Z", "date_only": false, "value": "2026-10-27T20:14:39.256758Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinity.sh/post/3myv2gcyvoz25", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "82c35071-6729-49cb-88f9-65c51a725ab6", "content": "Collabora Online Built-In CODE Server RCE \u2014 CVE-2026-110447. Shell injection in proxy.php, actively exploited since September. Webshells found on Nextcloud servers. CISA just added it to KEV.\n\nhttps://trinity.sh/posts/2026-10-27-collabora-built-in-rce/", "url": "https://bsky.app/profile/trinity.sh/post/3myv2gcyvoz25"}, {"timestamp": "2026-10-28T08:05:54Z", "date_only": false, "value": "2026-10-28T08:05:54.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-110447.yaml", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "801d1fa6-ee46-4d0d-b37c-50393b7dc8e6", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-110447.yaml"}, {"timestamp": "2026-10-28T17:05:15.835Z", "date_only": false, "value": "2026-10-28T17:05:15.835396Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3myxackaeahlg", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "25eb65d7-5bf7-4a2c-9ca4-c914670a08f6", "content": "CISA KEV | CVE-2026-110447 | Collabora / Collabora Online \u2013 Built-in CODE Server\n\nCISA lists this vulnerability as exploited in the wild. Check affected products and vendor guidance.\n\nSource: CISA KEV\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1337", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3myxackaeahlg"}, {"timestamp": "2026-10-29T10:03:36Z", "date_only": false, "value": "2026-10-29T10:03:36.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107922", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "0b509609-6d4f-4a60-9326-72439ca32688", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-110447-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CyRouteWolf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-29 10:02:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107922", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-29T15:31:12.949Z", "date_only": false, "value": "2026-10-29T15:31:12.949135Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fc-vulns.bsky.social/post/3myzljdnapw2q", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "92e8cab4-9aa2-4143-93d2-c568af4c142a", "content": "Watch this EPSS jump.\n\nCVE-2026-110447: EPSS +61.7 (11.6 \u2192 73.3, 0\u2013100).\n\nCollabora CODE Server before 26.4.303 (richdocumentscode): OS command injection in proxy.php \u2192 RCE when CODE isn't running; exploited in the wild (CWE-78).\n\nhttps://www.fc-vulns.com/cve/CVE-2026-110447/\n#fcvulns #EPSS", "url": "https://bsky.app/profile/fc-vulns.bsky.social/post/3myzljdnapw2q"}, {"timestamp": "2026-10-29T17:27:33.785Z", "date_only": false, "value": "2026-10-29T17:27:33.785348Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/xploitdigest-kev.bsky.social/post/3myzrzezd4e2y", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "743ac974-50f9-4c9c-8daf-67846ef5bb4c", "content": "CVE-2026-110447 \u2014 Collabora Online \u2013 Built-in CODE Server\nKnown to be exploited: CISA added it to its KEV catalogue on 23 Oct 2026.\n\nIn plain English: reachable over a network \u00b7 no login needed \u00b7 nobody has to click.\n\nxploitdigest.com/kev/CVE-2026-110447", "url": "https://bsky.app/profile/xploitdigest-kev.bsky.social/post/3myzrzezd4e2y"}, {"timestamp": "2026-10-29T18:30:23.294Z", "date_only": false, "value": "2026-10-29T18:30:23.294380Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3myzvjq2cm52k", "record": "cve-2026-110447", "field": "creation_timestamp", "uuid": "e3517b49-29e1-4187-9ac1-b6deda825801", "content": "Critical Nextcloud flaw exploited for months before disclosure: admins need a hunting checklist for web shells and a\u2026\n\nhttps://dev.to/affix_centersoftechserv/hunting-for-web-shells-after-the-nextcloud-code-flaw-cve-2026-110447-a-sysadmin-checklist-58d9\n\n#opensource #Linux", "url": "https://bsky.app/profile/getpacketai.bsky.social/post/3myzvjq2cm52k"}, {"timestamp": "2026-10-30T16:32:46.647Z", "date_only": false, "value": "2026-10-30T16:32:46.647", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110447", "record": "FKIE_CVE-2026-110447", "field": "lastModified"}, {"timestamp": "2026-10-30T17:13:25.064Z", "date_only": false, "value": "2026-10-30T17:13:25.064935Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3mz4boyscdc2h", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "3260d1e9-f217-4187-a4fe-90474fe581b3", "content": "Nextcloud + Collabora built-in CODE server app (CVE-2026-110447)? Attacked since Sep 10. Upgrade to 26.4.303+ or remove it (disabling isn't enough), then check:\n\n- unexpected PHP files in apps/richdocumentscode/\n- proxy.php?status hits\n- rotate secrets the web user can read", "url": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3mz4boyscdc2h"}], "metrics": {"as_of": "2026-10-30T20:34:43.708Z", "anchors": {"origin": {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-110447", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-110447", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-15T21:00:04Z", "date_only": false, "value": "2026-10-15T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Km_CKVuM60per-Kt9cYcm4cRFPdByGiibWs2OtLSLbyjBgM", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "8b96276d-fe3a-42a7-ad1a-dcde7a0a8407", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 755.685, "hours": 0.20991249999999997, "days": 0.008746354166666666, "min_seconds": 755.685, "max_seconds": 755.685, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-110447", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 755.685, "hours": 0.20991249999999997, "days": 0.008746354166666666, "min_seconds": 755.685, "max_seconds": 755.685, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-110447", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 153141.685, "hours": 42.53935694444444, "days": 1.7724732060185184, "min_seconds": 153141.685, "max_seconds": 153141.685, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-110447", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-15T21:00:04Z", "date_only": false, "value": "2026-10-15T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Km_CKVuM60per-Kt9cYcm4cRFPdByGiibWs2OtLSLbyjBgM", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "8b96276d-fe3a-42a7-ad1a-dcde7a0a8407", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1447621.393262, "hours": 402.1170536838889, "days": 16.754877236828705, "min_seconds": 1447621.393262, "max_seconds": 1447621.393262, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-14T02:27:42.315Z", "date_only": false, "value": "2026-10-14T02:27:42.315Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-110447", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T20:34:43.708Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 1446865.708262, "hours": 401.9071411838889, "days": 16.746130882662037, "min_seconds": 1446865.708262, "max_seconds": 1446865.708262, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-14T02:40:18Z", "date_only": false, "value": "2026-10-14T02:40:18+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-110447", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "795dd9f8-bd1f-4b8e-ba63-4ef197066fcc", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-10-30T20:34:43.708Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 1294479.708262, "hours": 359.57769673944443, "days": 14.982404030810185, "min_seconds": 1294479.708262, "max_seconds": 1294479.708262, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-15T21:00:04Z", "date_only": false, "value": "2026-10-15T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Km_CKVuM60per-Kt9cYcm4cRFPdByGiibWs2OtLSLbyjBgM", "record": "CVE-2026-110447", "field": "creation_timestamp", "uuid": "8b96276d-fe3a-42a7-ad1a-dcde7a0a8407", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-30T20:34:43.708Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}