Collabora

Vulnerable devices include PA-Series and VM-Series firewalls and the Panorama unified management portal.

Collabora has released a security update to patch an actively exploited zero-day in its Nextcloud office integration app.

The vulnerability has been used to plant web shells on Nextcloud servers since September.

The Collabora Online app integrates LibreOffice Online office with the Nextcloud platform.

Expo researchers used AI tools to create a three-part exploit chain in Chrome that could be used to take over the underlying Windows OS.

Google paid the researchers its top reward of two hundred and fifty thousand dollars for the exploit chain.

By the way, the hotfix sits behind the partner portal login, and that's one more login than the attackers needed.

Four, attackers are planting web shells on Nextcloud servers through the built-in Collabora app.

Whenever the app's document server is down, like right after a restart, anyone on the Internet can run commands on the Nextcloud server with one request.

Disabling the app leaves it exploitable, so update it or remove it.

And what it does is it uses a very familiar Homelab stack that we all kind of know.

It uses familiar tools such as NextCloud and Collabora Online.

And for Collabora, for those of you who don't know, it has its roots in LibreOffice, which has been going on for years and years.

And to be honest, I never understand why people Like some family members, like my brother, he will subscribe to Office 365 and pay, what, about $100 a year for it.

And I say, why do you do that? Just download LibreOffice.

If you're looking for something to collaborate online with though and you've and you don't want to use any of the existing ecosystems, Google or Microsoft or Dropbox.

There is Collabora.

There we go, Collabora online.

And that's available where browser-based LibreOffice editing and real-time collaboration are required.

So there is an ecosystem you can use if you want.

And what we did was built this amazing collaborative stand with help from Diogo and almost I swear his entire Ubuntu Portugal community.

Um, some of whom worked at Collabora, and then my friend Marius, who then was at Nextcloud, who is amazing.

And it was like, okay, so first of all, they built this beautiful stand page, and I don't know if, um, the technology that FOSDEM u- uses is a little bit quirky, but they knew it.

Uh, and so they built us this wonderful page.

It covers the whole stack, the operating system, office software, collaboration tools, cloud services, uh, management tools, and even AI.

On the collaboration side, there's a companion bundle called Minsbureau, which pulls together Nextcloud, Collabora Element, and OpenProject.

The operating system underneath all that, NixOS.

Now, core developer Victor Greve summed up the motivation, you know, basically referring back to when they lost email.

Yeah, it's not its own custom thing.

It is part of Germany's digital, uh, digital sovereignty project, but it makes use of Collabora Online.

Is Collab...

Where's Collabora based out of? So Collabora Online is built off of LibreOffice, but where is Collabora actually from? Ah, okay.

Apparently they are in the United Kingdom.

I did not know that.

So we have Collabora Online.

We have Nextcloud.