An update can settle a software question without settling an incident. Nextcloud operators need to record both decisions. Collabora's 14 October critical advisory (CVSS 4.0: 9.2) describes unauthenticated operating-system command injection in proxy.php. Its Nextcloud richdocumentscode app is vulnerable when the bundled CODE server is stopped, including during restarts, upgrades or crashes. Versions before 26.4.303 require an upgrade to 26.4.303 or later, or removal. Disabling is insufficient. End-of-life Nextcloud 29 and earlier require upgrading or app removal. Standalone Collabora Online is excluded. This is CVE-2026-110447, not CVE-2025-66208, whose fix does not prevent it. The deployment boundary is the starting point for a useful response. An organisation-wide product search can identify candidates, but it should not become a declaration that every matching server is affected. Ask the service owner to identify the installed component and produce the evidence supporting its classification. The public record began before the advisory An administrator's 11 September report describes successful attacks against multiple installations, PHP web shells in the app directory and discovery commands seeking credential and cryptocurrency material. The reviewed requests did not show explicit archiving, upload or exfiltration commands. That is not proof that nothing left. A maintainer's 18 September reply called the pictured post-fix processes harmless while recommending removal of lingering shx*.php files. Suspicious arguments alone therefore do not establish fix failure. The same discussion says execution runs as the web-server account, placing accessible data and secrets potentially in scope. It is administrator-reported evidence, not an actor attribution or victim census. The fixed…