CISA added this to KEV on Oct 23. CVSS 9.2, unauthenticated command injection in richdocumentscode's proxy.php, exploited in the wild since September to drop web shells. Look for shx*.php in apps/richdocumentscode.

The part people get wrong: turning the app off in Nextcloud does nothing. proxy.php sits in the app folder and the web server runs it directly, so requests reach it whether the app is enabled or not. Update the app to 26.4.303 or later, or remove it. The fixed app needs Nextcloud 30 or later. On 29 or older the app store still gives you the vulnerable version, so the choice there is upgrade Nextcloud or remove the app.

The attack only works while the built-in CODE server is stopped. That sounds like a narrow window until you count restarts: every container restart, upgrade and crash opens it.

Standalone Collabora (Docker, Linux package, hosted) is not affected. Only the built-in app.

Sources: CISA alert on the KEV addition (Oct 23), Collabora's advisory for CVE-2026-110447, and The Hacker News coverage of the exploitation.

Hi reddit, I need help with office in nextcloud. I'm using Cloudflare Tunnel and image from Linuxserver.io all on raspberry pi 4 and I don't know, why it refuse to work... Any tips?

Solved - see my followup post below.

I've had a NextCloud running for a number of years. I shutdown my docker container when the PHPShell came out a couple of days ago. I pulled the new 35.0.2 this morning. Everything seems to be working, but...

In the Basic Settings page, there is a banner saying that the cron job hasn't run for 3 days. I can seen the cron job being invoked in the syslog every 5 minutes. No warnings of issues within the NextCloud logging page.

The strange bit is that the cron script is the same one that been running since I moved to a Docker based system about a year ago.

docker exec -u www-data nextcloud-app /usr/local/bin/php -f /var/www/html/cron.php

If I run the same command from the command line, I get the same (lack of) response. About a 1 second delay or less to return to the command line prompt. Nothing in the NextCloud log files.

Prior to the pull of the 35.0.2 image, I did do an apt update && apt upgrade of the Ubuntu 24.04.5 system.

Anyone got a way to monitor what is happening within the cron.php script? Or other thoughts on things to check? I can't figure out if the cron script is working and the detector got broken in the upgrade or the detector is working and the cron script is failing. I'm guessing that it is the latter.

Thanks

Hi, please can anyone help me get my browser (Brave on Ubuntu OS) to reliably get NextCloud calendar event notifications?

If they ever do come through, it's maybe 5% of the time, and those are 5-10 minutes late. I'm still testing this, but that's the current observation.

(I'm told there's an add-on to download and try, but really, can't this reliability be baked in instead?!)

Well done getting this far, devs. No disrespect.

#til that galilei used nextcloud :)

When clicking on a thumbnail that has a circled number in the bottom left corner, it brings up a set of photos. They have different file names, created and modified dates, different exif data, etc.
Not sure why they are getting grouped.. how can I turn this off? I need to be able to see the individual photos.