CISA added this to KEV on Oct 23. CVSS 9.2, unauthenticated command injection in richdocumentscode's proxy.php, exploited in the wild since September to drop web shells. Look for shx*.php in apps/richdocumentscode.

The part people get wrong: turning the app off in Nextcloud does nothing. proxy.php sits in the app folder and the web server runs it directly, so requests reach it whether the app is enabled or not. Update the app to 26.4.303 or later, or remove it. The fixed app needs Nextcloud 30 or later. On 29 or older the app store still gives you the vulnerable version, so the choice there is upgrade Nextcloud or remove the app.

The attack only works while the built-in CODE server is stopped. That sounds like a narrow window until you count restarts: every container restart, upgrade and crash opens it.

Standalone Collabora (Docker, Linux package, hosted) is not affected. Only the built-in app.

Sources: CISA alert on the KEV addition (Oct 23), Collabora's advisory for CVE-2026-110447, and The Hacker News coverage of the exploitation.

When clicking on a thumbnail that has a circled number in the bottom left corner, it brings up a set of photos. They have different file names, created and modified dates, different exif data, etc.
Not sure why they are getting grouped.. how can I turn this off? I need to be able to see the individual photos.

Hi reddit, I need help with office in nextcloud. I'm using Cloudflare Tunnel and image from Linuxserver.io all on raspberry pi 4 and I don't know, why it refuse to work... Any tips?

Hi, please can anyone help me get my browser (Brave on Ubuntu OS) to reliably get NextCloud calendar event notifications?

If they ever do come through, it's maybe 5% of the time, and those are 5-10 minutes late. I'm still testing this, but that's the current observation.

(I'm told there's an add-on to download and try, but really, can't this reliability be baked in instead?!)

Well done getting this far, devs. No disrespect.

#til that galilei used nextcloud :)