Pivoting on CVE-2026-110447 indicators in Collabora richdocumentscode

A researcher analyzed network indicators from exploitation of CVE-2026-110447 in richdocumentscode: two source IPs (139.28.18.122 and 89.38.98.50), requests to /apps/richdocumentscode/proxy.php?status and a web shell with SHA-256 hash 4b9fbd06…40562. The author recommends pivoting on payload structure rather than blocking addresses or webhook.site.

• Attacks on September 10–11 came from 139.28.18.122, a September 14 attempt from 89.38.98.50
• Callbacks went to webhook.site with identifiers 45060ed4… and 774cf5e1…
• The web shell is a one-line PHP file with SHA-256 hash 4b9fbd06…40562
• A body search for richdocumentscode returned 121,131 matches on October 20, 2026