Nextcloud: Confusion over site disruption Cyber Cyberattack is confirmed

Nextcloud confirmed on Monday that its website was temporarily taken offline due to a cyberattack, following initial confusion and mixed statements from the company. The incident occurred on Sunday, affecting the main website at nextcloud.com. Users expressed concern through the Nextcloud Help Forum, prompting the company’s Developer Relations team to initially attribute the outage to infrastructure issues. They stated that the site would be restored from a backup and emphasized that it had no impact on user data, downloads, or updates. The situation took a turn after further inquiries from heise security. A spokesperson for Nextcloud admitted that a cyberattack was the cause of the disruption. “Our website was the target of an attack on Sunday evening,” they said. “We immediately isolated the affected server and are currently investigating exactly what happened.” The homepage was subsequently restored from a backup onto a new server. The company reiterated that this incident did not affect users' servers or their services, as these operate on separate infrastructure from the public-facing website. Nextcloud runs its website using WordPress as its content management system. Over the weekend, multiple cybersecurity firms identified a chain of vulnerabilities in the WordPress core known as “WP2Shell.” These flaws allow attackers to inject malicious code into websites. Several attacks exploiting these weaknesses have already been documented in the wild. In response to further questions from heise security, Nextcloud acknowledged that it could not rule out the possibility that WP2Shell was responsible for the outage. “We are also examining this direction,” the company added, though it noted that confirmation was still pending. The company has not yet released detailed findings from its investigation. It continues to monitor the situation and plans to provide more information once additional details become available. At present, there is no indication that the breach compromised user data or disrupted other services. Nextcloud has assured customers that all critical operations, including the app store and download functionality, remain unaffected. The incident highlights the growing risks associated with using open-source platforms like WordPress for high-profile websites. While WordPress is widely used and generally secure, recent discoveries of critical vulnerabilities underscore the need for continuous monitoring and timely patching. Cybersecurity experts warn that such vulnerabilities can be exploited by both individual hackers and organized groups seeking to disrupt services or steal sensitive information. In light of the ongoing investigation, Nextcloud is likely to take steps to enhance its security measures, particularly around its public-facing infrastructure. This may include updating its WordPress setup, implementing stronger access controls, and increasing surveillance for potential threats. The company has also advised users to ensure their systems are up to date with the latest security patches, especially given the widespread nature of the WP2Shell vulnerabilities. For now, the focus remains on determining the exact cause of the outage and assessing whether any broader implications exist. As Nextcloud continues its analysis, the broader cybersecurity community will be watching closely to see how the company responds and what lessons might be learned from the incident. Until further details emerge, the situation remains under active review.