Critical React2Shell flaw actively exploited in China-linked attacks
Recorded: Dec. 5, 2025, 9:13 p.m.
| Original | Summarized |
Critical React2Shell flaw actively exploited in China-linked attacks News Featured Critical React, Next.js flaw lets hackers execute code on servers North Korea lures engineers to rent identities in fake IT worker scheme CISA warns of Chinese "BrickStorm" malware attacks on VMware servers Marquis data breach impacts over 74 US banks, credit unions Barts Health NHS discloses data breach after Oracle zero-day hack FBI warns of virtual kidnapping scams using altered social media photos A Practical Guide to Continuous Attack Surface Visibility EU fines X $140 million over deceptive blue checkmarks Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityCritical React2Shell flaw actively exploited in China-linked attacks Critical React2Shell flaw actively exploited in China-linked attacks By Bill Toulas December 5, 2025 Multiple China-linked threat actors began exploiting the React2Shell vulnerability (CVE-2025-55182) affecting React and Next.js just hours after the max-severity issue was disclosed. Break down IAM silos like Bitpanda, KnowBe4, and PathAI Related Articles: Actively Exploited Bill Toulas Previous Article Comments
abides - 6 hours ago I think it should be mentioned that Vercel and Netlify mitigated this vector before it was announced. Not sure the % of next.js sites hosted outside of these platforms or if other platforms also performed mitigation. Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories ChatGPT is down worldwide, conversations disappeared for users Cloudflare down, websites offline with 500 Internal Server Error Marquis data breach impacts over 74 US banks, credit unions Sponsor Posts What you’re overlooking to protect your business Overdue a password health-check? Audit your Active Directory for free AI is a data-breach time bomb: Read the new report Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe! Empowering IT teams with intelligence driven cyber threat research. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Critical React2Shell Flaw Actively Exploited in China-Linked Attacks The December 5, 2025, BleepingComputer report details an immediate and concerning exploitation of the React2Shell vulnerability, affecting React and Next.js frameworks. This vulnerability, CVE-2025-55182, presents a significant risk due to its ease of exploitation and the potential for remote code execution (RCE) within server contexts, requiring no authentication. The issue was discovered and reported by Lachlan Davidson, prompting rapid response from security researchers including Stephen Fewer and Joe Desimone. The core of the threat lies in the “Flight” protocol used in React Server Components (RSC), a flaw that allows unauthorized code execution. Multiple, China-linked threat actors, including Earth Lamia and Jackpot Panda, swiftly began utilizing publicly available proof-of-concept (PoC) exploits almost immediately following the vulnerability’s disclosure. These groups demonstrate aggressive exploitation techniques, characterized by iterative testing, manual debugging, and the execution of commands like ‘whoami’ and ‘id,’ alongside attempts to create files and read sensitive system information. This behavior underscores a sophisticated, real-time approach to attack refinement. AWS observed diverse attack patterns, noting shared anonymization infrastructure amongst the threat groups, complicating attribution efforts. Earth Lamia primarily focuses on web application vulnerabilities, targeting sectors including financial services, logistics, retail, IT, universities, and government entities across Latin America, the Middle East, and Southeast Asia. Conversely, Jackpot Panda’s targets are concentrated in East and Southeast Asia, with a focus on gathering intelligence related to corruption and domestic security. The rapid response has led to immediate mitigation efforts, including action taken by Vercel and Netlify, highlighting a degree of preparedness within the Next.js ecosystem. Further, the Assetnote platform released a React2Shell scanner on GitHub to assist in identifying vulnerable environments. Researchers are actively tracking the evolving attack strategies, highlighting the importance of proactive security measures and continuous monitoring in response to emerging threats. This incident emphasizes the urgency of patching vulnerabilities and implementing robust attack surface visibility strategies to prevent similar exploitation. |