Nextcloud’s Built-in CODE Server is being exploited: update or remove it
A command injection bug in the Collabora Online Built-in CODE Server app for Nextcloud was exploited in September and October 2026. Disabling the app doesn’t protect you. Update it to 26.4.303 or later, or remove it,…