Loading story…
Threat actors are actively exploiting React2Shell, a critical remote code execution flaw in React Server Components tracked as CVE-2025-55182, with related exposure also noted in Next.js as CVE-2025-66478. The bug stems from insecure deserialization in the React Server Components Flight protocol and allows unauthenticated attackers to upload malicious payloads and execute arbitrary code on vulnerable internet-facing servers. Public disclosure was quickly followed by advisories, proof-of-concept code, and reports of broad exploitation, while Microsoft and other researchers said hundreds of machines had already been hacked.
Follow-on campaigns have been widespread and largely opportunistic, ranging from credential-harvesting operations to malware deployment against organizations in multiple sectors and regions. Cisco Talos-linked reporting said at least 766 servers were compromised by an automated campaign that stole SSH keys, cloud tokens, API keys, Kubernetes and GitHub credentials, Docker metadata, and other environment secrets, including keys tied to AI platforms and payment services. Other investigations tied exploitation to XMRig, RustoBot, Kaiji, Sliver, CrossC2, Tactical RMM, VShell, and EtherRAT, along with persistence, reconnaissance, DNS-based exfiltration, and SSH key installation, underscoring how rapidly the vulnerability was weaponized after disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos reported a widespread automated campaign exploiting internet-facing vulnerable React Server Components instances, attributing activity to UAT-10608. The payload harvested credentials, SSH keys, cloud tokens, API keys, and other secrets, with at least 766 servers compromised across multiple regions.
Reporting in early February 2026 indicated a notable change in how threat actors were exploiting React2Shell. This suggests the campaign evolved beyond its initial exploitation patterns.
By mid-December, Microsoft counted hundreds of compromised machines tied to React2Shell exploitation, indicating the campaign had scaled significantly. This represented a major escalation in observed impact.
BI.ZONE reported that adversaries exploited React2Shell during December 2025, including attacks on Russian companies in the insurance, e-commerce, and IT sectors. Observed post-exploitation included XMRig, RustoBot, Kaiji, Sliver, CrossC2, Tactical RMM, VShell, EtherRAT, persistence, and DNS-based exfiltration.
Threat researchers reported that CVE-2025-55182 was being actively exploited in the wild. This established that the vulnerability had moved from disclosure into real-world attacks.
JPCERT/CC published an advisory covering CVE-2025-55182 in React Server Components. The advisory reflects formal defender awareness and guidance around the vulnerability.
A GitHub repository published a proof-of-concept script for CVE-2025-55182, demonstrating exploitation of the React SSR/RSC remote code execution flaw. Public exploit code likely lowered the barrier for attackers to weaponize the bug.
A detailed write-up described React2Shell as a critical RCE affecting React Server Components and Next.js, including CVE-2025-55182 and CVE-2025-66478. The publication expanded public technical understanding of the flaw and affected ecosystem.
A public CVE entry for CVE-2025-55182 appeared, identifying the React Server Components server-side remote code execution issue later dubbed React2Shell. This marks the earliest public disclosure point visible in the references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cybersecuritydive.com
Open sourcecybersecuritydive.com
Open sourcebi-zone.medium.com
Open sourcejpcert.or.jp
Open sourcetheregister.com
Open sourcectrlaltintel.com
Open sourcegithub.com
Open sourceesentire.com
Open sourcehackerone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers rapidly weaponized **React2Shell** (`CVE-2025-55182`), a critical flaw in React Server Components and React/Next.js applications that enables unauthenticated remote code execution. Security reporting described the bug as one of the most consequential vulnerabilities of the year, with exploitation spreading across criminal and state-linked operations and defenders urged to prioritize emergency patching and monitoring. The flaw was also tied to broader shifts in the threat landscape, including more resilient malware campaigns, cloud-focused intrusions, and increasingly AI-enabled attack activity. Large-scale exploitation followed disclosure, with more than **8.1 million attack sessions** observed from over **8,000 unique source IPs** spanning **101 countries**, including substantial traffic routed through major cloud providers such as AWS. Researchers also linked the vulnerability to follow-on malware activity, including the **EtherRAT** campaign, which used Ethereum smart contracts for command-and-control, while reporting highlighted advanced evasion methods such as AMSI bypass and rapid IP rotation that reduced the effectiveness of static defenses. The volume and sophistication of the attacks underscored the need for behavioral detection, dynamic threat intelligence, and immediate remediation of exposed internet-facing systems.
Jul 9, 2026
A severe remote code execution vulnerability tracked as **`CVE-2025-55182`** was disclosed in **React Server Components** and quickly became known as **React2Shell**, with reporting indicating that exploitation spread soon after public disclosure. Security coverage from eSentire, BitSight, and Computer Weekly described the flaw as affecting React and Next.js environments, warned defenders to assess internet-exposed applications, and noted that attackers were moving from proof-of-concept activity toward broader exploitation. Public GitHub repositories rapidly appeared with exploit code, scanners, and remediation-focused projects, including tools explicitly labeled for **`CVE-2025-55182`** and **React2Shell** detection or exploitation. Repositories such as **`React2Shell-PoC`**, multiple **PoC scanners**, auto-exploit projects, and checkers lowered the barrier to weaponization, while at least one repository advertised fixes for React 19 users. The volume and speed of public tooling indicate that organizations running React Server Components or Next.js services faced immediate pressure to identify exposed systems, apply vendor fixes, and monitor for signs of remote code execution attempts.
Jul 12, 2026
A critical unauthenticated remote code execution flaw in React Server Components, tracked as **CVE-2025-55182** and widely dubbed **React2Shell**, exposed React 19 server-side packages and downstream frameworks including **Next.js App Router**. The bug stems from unsafe deserialization in the RSC/Flight protocol, allowing a single crafted HTTP request to reach vulnerable server function paths and execute arbitrary code in default deployments, including some apps that did not explicitly define Server Function endpoints. React released fixes for `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in **19.0.1**, **19.1.2**, and **19.2.1**, while Next.js issued related guidance under **CVE-2025-66478** for affected 15.x, 16.x, and certain canary releases; vendors stressed that WAF rules and hosting-provider mitigations are only temporary and that patching and redeployment are required. Security firms and vendors reported rapid weaponization after disclosure, with public exploit code, Nuclei and Metasploit support, and confirmed in-the-wild exploitation against internet-facing Next.js and other RSC-enabled applications. Reported post-compromise activity included **XMRig** cryptominers, **Sliver**, **MeshAgent**, **Cobalt Strike**, **SNOWLIGHT**, **ShadowPAD**, credential theft targeting cloud and Kubernetes environments, and persistence mechanisms tied to multiple China-linked actors and other threat groups; CISA added the flaw to its **Known Exploited Vulnerabilities** catalog. Researchers estimated broad exposure across cloud environments and web assets, while Cloudflare, Akamai, Imperva, Google Cloud, and others deployed emergency protections, underscoring the scale and urgency of remediation.
Jul 9, 2026