Morning. Today's theme is the gap between a signal and a verdict: one flaw just got official confirmation, and one claim has nothing behind it yet.
CISA confirms the Collabora Nextcloud flaw is being exploited
CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23. The flaw is an unauthenticated operating system command injection (CVSS 9.2) in the Collabora Online Built-in CODE Server app for Nextcloud, reachable through proxy.php when the CODE server is not running. That downtime window is the trap: a routine restart, upgrade, or crash opens the vulnerable path. Attackers have used it to plant PHP web shells and search for credential stores, password manager artifacts, and crypto wallets.
What to do: upgrade richdocumentscode to 26.4.303 or later, or remove the app entirely, since disabling it alone is not enough, and Nextcloud 29 and older cannot install the patched version. Federal agencies face an October 26 deadline. Everyone else should treat patching plus a web shell hunt as one job.
Qilin lists Commonwealth Community Bank, and that is all we know
Qilin published a leak-site listing naming Commonwealth Community Bank on October 24, according to ransomware trackers. No breach, data theft, encryption, scope, or root cause is confirmed. A listing is a pressure tactic as much as it is a claim, so the right move is to watch for an official statement and to check your own logs, identity activity, and backups before treating the post as proof of anything.
Also on the radar: CISA updates the PHP2Shell alert
CISA updated its PHP2Shell alert on October 23 with a SIGMA detection rule and partner resources. The patch guidance is unchanged (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35), but defenders still running unpatched PHP now have a detection starting point. If you patched PHP this week, hunt for web shells anyway.
Fresh in the IoC Library: the Collabora CODE Server exploitation artifacts.
Full entries with huntable indicators: kevinthecyberguy.com/vuln-watch and kevinthecyberguy.com/ioc-library
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com