Attackers planted web shells through Collabora's Built-in CODE app while its document server was down; versions before 26.4.303 are affected.