React2Shell blog update 🚨 compromised Next.js nodes are rapidly being enlisted into botnets; threat actor activity reaches ~80 source countries; and more. https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far
#React2Shell #Nextjs #GreyNoise #ThreatIntel

👀 React2Shell attacker profiles fresh from GreyNoise telemetry: https://info.greynoise.io/hubfs/PDFs-Sales-Marketing/GreyNoise-React2Shell-Attacker-Profiles.pngAlso, don't miss the latest contribution from GreyNoise Labs on React2Shell: https://www.labs.greynoise.io/grimoire/2025-12-09-react2shell-meshcentral/

#React2Shell #Nextjs #CVE202555182 #CVE #GreyNoise

En las últimas 24 horas se han detectado vulnerabilidades graves en dispositivos KVM chinos, explotación de 13 años en QEMU y fallos que permiten desactivar BitLocker en Windows, además de un análisis profundo de React2Shell y una alerta del FBI sobre secuestros virtuales por manipulación fotográfica, mientras un banco de Chipre fortalece su defensa ante ciberataques con Cloudflare. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 09/12/25 📆 |====

🔓 VULNERABILIDADES GRAVES EN SWITCH KVM CHINO

Un dispositivo de gestión remota de bajo costo fabricado por Sipeed presenta una grave vulnerabilidad que permite la grabación no autorizada de audio y otros fallos de seguridad críticos. Esta brecha pone en riesgo la confidencialidad y la integridad de la información gestionada a través del switch. Recomendamos evaluar el uso de estos dispositivos y aplicar parches o mitigaciones específicas. Conoce más detalles sobre estas fallas y cómo proteger tus sistemas 👉 https://djar.co/vddme

🛡️ POSESIÓN DE OBJETOS COM PARA DESACTIVAR BITLOCKER

Investigadores han descubierto que múltiples interfaces COM poco documentadas en Windows pueden ser explotadas para desactivar el cifrado Bitlocker sin autorización. Esta técnica podría permitir a atacantes evitar las protecciones de cifrado y acceder a datos sensibles almacenados en discos duros. Es vital reforzar las políticas de seguridad y controlar estrictamente los accesos a estas interfaces internas. Explora el método y recomendaciones para blindar Bitlocker aquí 👉 https://djar.co/gmEf

🐚 ANÁLISIS PROFUNDO DE LA VULNERABILIDAD REACT2SHELL CVE-2025-55182

Se presenta un estudio técnico detallado sobre la vulnerabilidad React2Shell, que aprovecha errores de deserialización para ejecutar código malicioso en frameworks afectados. El análisis incluye la identificación de cadenas de gadgets, escenarios de explotación, y su impacto en aplicaciones web modernas. Entender esta amenaza es esencial para desarrolladores y equipos de seguridad que buscan proteger sus entornos. Descubre el informe completo y cómo mitigar este riesgo 👉 https://djar.co/ZV3Jr

📸 ALERTA DEL FBI: SECUESTROS VIRTUALES MEDIANTE MANIPULACIÓN DE FOTOS ONLINE

El FBI ha alertado sobre una modalidad de fraude en la que criminales manipulan fotografías compartidas en redes sociales para crear falsas pruebas de vida de supuestas víctimas y exigir rescates por secuestros virtuales. Esta técnica sofisticada pone en evidencia la importancia de una gestión cuidadosa de la información personal en internet y la implementación de medidas de verificación ante solicitudes sospechosas. Infórmate sobre cómo evitar ser víctima de estas estafas 👉 https://djar.co/yN5Vwg

🏦 CASO DE ÉXITO: BANCO DE CHIPRE Y CLOUDFLARE PARA DEFENDERSE DE CIBERATAQUES

Uno de los bancos más grandes de Chipre ha logrado eliminar retrasos críticos en la respuesta a ciberataques y mantener la disponibilidad continua de sus servicios esenciales mediante soluciones integradas con Cloudflare. Este caso evidencia cómo las alianzas tecnológicas estratégicas y la implementación de protecciones avanzadas permiten fortalecer la resiliencia de infraestructuras financieras ante amenazas persistentes. Descubre los detalles y aprendizajes clave de esta colaboración 👉 https://djar.co/Bh1sQG

🐛 EXPLOTACIÓN DE UNA VULNERABILIDAD DE 13 AÑOS EN QEMU

Se ha documentado la explotación de un bug en QEMU, el popular emulador y virtualizador de código abierto, que se remonta a más de una década. Este caso resalta la importancia crítica de mantener actualizado el software de virtualización para evitar que vulnerabilidades antiguas sean aprovechadas por atacantes. Mantener los sistemas parches al día es fundamental para proteger entornos virtuales. Conoce más sobre esta vulnerabilidad y mejores prácticas para mitigación 👉 https://djar.co/8mhb1

React2Shell Exploitation in the Wild: CVE-2025-55182 Analysis

Within 24 hours of the React Server Components RCE disclosure (CVE-2025-55182, CVSS 10.0), we observed active exploitation campaigns targeting vulnerable Next.JS applications, leading to cryptojacking operations across multiple continents.

Our latest blog post details:

• Real-world incident response from compromised production servers
• Timeline of attack progression from initial recon to persistence
• Multiple threat actor clusters exploiting the same vulnerability
• AI-assisted malware development patterns
• Forensic analysis of deployed cryptominers and backdoors

Key Findings:
- First exploitation attempts detected as early as December 5th, 2025
- Attackers refined their tooling within 18 hours between reinfection attempts
- Targets span US, Europe, and Southeast Asia, including large enterprise environments
- Multiple persistence mechanisms: systemd units, shell injection, custom SSH servers

Full technical analysis on our blog:

https://tlpblack.net/blog/20251209-the-anatomy-of-a-react2shell-compromise

Hashes:
0c748b9e8bc6b5b4fe989df67655f3301d28ef81617b9cbe8e0f6a19d4f9b657
129cfbfbe4c37a970abab20202639c1481ed0674ff9420d507f6ca4f2ed7796a
466a46ed4f80ef12d2e2ba1c8014315a4aa33483135386af57bec5d6a57a8359
5bae25736a09de5f4a0f9761d2b7bfa81ca8dba39de2a724473c9d021a65daa9
609e5af9394e68d96a8a906a893d0544e39f4b88e15f3b4131494c1f1b278b6f
67aea5b0ffceacaa932c47b3cddd527d393856fa900a19a225afe9203ce005e0
69f2789a539fc2867570f3bbb71102373a94c7153239599478af84b9c81f2a03
865d0bbf8b953ff317dd3aafde10d9fe0f95c2befd83b570c02ab802b177cda0
9674bf61fc78daf4eec4e378df3f746ddccf532de5609e278ddcd02b98c24de1
9959ee0d49894fe9e3d753bf8847f522bafec4f7c644ead5648d18e9d32de252
ba43e447e63611d365300bf2e8e43ccb02ea112778d0d555ef9a9ccf6169808b
dd630c880e628fde6018d2d6a276007d01de7e6c7d46e10000231f4a35cf0f9e
e76f54b7b98ba3a08f39392e6886a9cb3e97d57b8a076e6b948968d0be392ed8

C2 IP Addresses:
39.97.229[.]220
43.247.134[.]215
45.76.155[.]14
45.157.233[.]80
46.36.37[.]85
47.84.113[.]198
192.9.245[.]121
193.34.213[.]150

Stay safe!

🚨 Plugin update: React2ShellPlugin (CVE-2025-55182).

Backdoor detection added - 16k+ Next.js servers detected with in-memory webshells allowing remote code execution.

Results: https://leakix.net/search?scope=leak&q=%2Bplugin%3AReact2ShellPlugin+%2Bdataset.infected%3Atrue

New analysis of #React2Shell CVE-2025-55182 probes and payloads hitting our canaries via @albinolobster. Upshot is that attackers don't seem to be doing all they *could* do with this vulnerability yet, have mostly been sticking to familiar patterns for now.

https://www.vulncheck.com/blog/react2shell-canaries

CVE-2025-55182

GG, no re.
And people wonder why we serve only static web pages at work. (it's a lot more effort, but at least nobody is gonna take over the web server itself)

Exploitation of recent React RCE vul (CVE-2025-55182 - #React2Shell) leading to #Mirai infection ⤵️

Botnet Mirai C2 domains 📡:
effeminate.fuckphillipthegerman .ru
trap.fuckphillipthegerman .ru
tranny.fuckphillipthegerman .ru

Botnet Mirai C2 servers , all hosted at FORTIS 🇷🇺:
138.124.72.251:52896
138.124.69.154:60328
5.144.176.19:60328

Mirai #malware sample 🤖:
https://bazaar.abuse.ch/sample/ee2fe11a7f43aba14f37897b7c69e2c4b26eef20a8854a838353b59866ee4861/

Payload delivery host 🌐:
https://urlhaus.abuse.ch/host/172.237.55.180/

Releated IOCs 🦊:
https://threatfox.abuse.ch/browse/tag/CVE-2025-55182/

⚠️ Podverse Alpha Update ⚠️

I'm shutting off the Alpha website for the night, as there is a critical security vulnerability with the version of Next.js it is using (CVE-2025-55182).

Should have it redeployed and patched tomorrow.

Good video explaining the CVE: https://www.youtube.com/watch?v=s81dVUM-cQM

Thanks to @suorcd or notifying me.

#podverse #pv2

We haven't seen a CVSS 10.0 this scary since #Log4Shell. 🚨
So we launched the exploit and here is the proof. 👇👇👇

Everyone talks about detecting #React2Shell (CVE-2025-55182). But detection can only take you so far.

To *truly* know if you are exposed to this CVSS 10.0 RCE, you need to validate it.

So we launched the exploit.

We updated our offensive security suite to safely execute the full attack chain against your infrastructure.

Here is how you validate your risk in seconds (see the evidence below 👇):

🚀 Validate directly with Sniper: Auto-Exploiter

Action: Launch Sniper: Auto-Exploiter on the target.

Result: The smoking gun. It executes the payload and confirms RCE.

Proof: As you can see from the report highlights, it achieves code execution as user Next.js and captures full command history.

This isn't a simulation. It's a confirmed RCE path on a Linux target running Next.js.

Why this matters: Standard scanners might flag your safe apps as vulnerable (FPs) or miss modified instances (false negatives). Validation removes the doubt.

Don't guess. Exploit it (safely) before they do.

Run the validation now https://pentest-tools.com/exploit-helpers/sniper

#CheckPoint has elaborated on the critical #React2Shell vulnerability, CVE-2025-55182, that affects React 19.x and related server-side frameworks such as Next.js 15.x/16.x. The vulnerability enables unauthenticated remote code execution via malicious HTTP requests targeting the server’s decoding process. Exploitation allows attackers to gain full control over application servers...

https://blog.checkpoint.com/securing-the-cloud/what-is-react2shell-cve-2025-55182-in-plain-english-and-why-check-point-cloudguard-waf-customers-carried-on-with-their-day/

🚨 Execute arbitrary code on the server and even compromise the underlying infrastructure. This is what an attacker can do by exploiting CVE-2025-55182.

How can the exploitation of #React2Shell be prevented, detected, and mitigated? 👇🏻

https://www.tarlogic.com/blog/cve-2025-55182-react-server-components/

Find out if you are vulnerable to the React2Shell vulnerability, covering both official tracking IDs:

• React Server Component exposure – CVE-2025-55182
• Next.js App Router RCE chain – CVE-2025-66478

#secpoint #secpointpenetrator #nextrce #react2shell #cve #cybersecurity #vulnerabilityscanning #nextjs #react

Here We Go Again With Another Critical Ivanti Endpoint Manager Bug

I feel like this is groundhog day as we have yet another critical Ivanti Endpoint Manager bug to deal with. This time around versions 2024 SU4 and below are vulnerable to stored cross-site scripting enabling attackers to remotely execute JavaScript code. Tracked as CVE-2025-10573 with a CVSS score of 9.6 out of 10. The vulnerability was patched on December 9, 2025 so you should patch all the things now.

https://itnerd.blog/2025/12/09/here-we-go-again-with-another-critical-ivanti-endpoint-manager-bug/

🚨 CRITICAL: Fortinet, Ivanti, SAP patch auth bypass & code exec flaws (e.g. CVE-2025-59718, CVE-2025-10573, CVE-2025-42880). Affects FortiOS, FortiWeb, Ivanti Endpoint Manager, SAP Solution Manager. Patch ASAP & disable risky features! https://radar.offseq.com/threat/fortinet-ivanti-and-sap-issue-urgent-patches-for-a-9a0f9a74 #OffSeq #Vulnerability #SysAdmin

Tiens, un bon vieux XSS via curl sous windows

⬇️
https://github.com/osman1337-security/CVE-2025-54100/

( :twitter: https://x.com/osman1337_/status/1998494447483400373 )
👇
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54100

[related]
⬇️
https://www.bleepingcomputer.com/news/security/microsoft-windows-powershell-now-warns-when-running-invoke-webrequest-scripts/

#CyberVeille #CVE_2025_54100

As Microsoft explains, this mitigates a high-severity PowerShell remote code execution vulnerability (CVE-2025-54100), which primarily affects enterprise or IT-managed environments that use PowerShell scripts for automation, since PowerShell scripts are not as commonly used
2/3

Here are the publicly disclosed ones.

Command injection in GitHub Copilot for JetBrains:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64671

an command injection in PowerShell:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54100

Here's the EITW one. It's an LPE in Cloud Files Mini Filter Driver.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221

Find out if you are vulnerable to the React2Shell vulnerability, covering both official tracking IDs:

• React Server Component exposure – CVE-2025-55182
• Next.js App Router RCE chain – CVE-2025-66478

#secpoint #secpointpenetrator #nextrce #react2shell #cve #cybersecurity #vulnerabilityscanning #nextjs #react

🚨 CVE-2025-6218: RARLAB WinRAR Path Traversal Vulnerability has been added to the CISA KEV Catalog

CVSS: 7.8

https://darkwebinformer.com/cisa-kev-catalog/

🚨 CRITICAL: Fortinet, Ivanti, SAP patch auth bypass & code exec flaws (e.g. CVE-2025-59718, CVE-2025-10573, CVE-2025-42880). Affects FortiOS, FortiWeb, Ivanti Endpoint Manager, SAP Solution Manager. Patch ASAP & disable risky features! https://radar.offseq.com/threat/fortinet-ivanti-and-sap-issue-urgent-patches-for-a-9a0f9a74 #OffSeq #Vulnerability #SysAdmin

SAP Solution Manager: risolta una falla critica di con Severity CVSS da 9.9

SAP ha appena pubblicato l’ultimo aggiornamento di sicurezza annuale, che riporta 14 nuovi bug di sicurezza sanati. Tra questi unasupport.sap.com/en/my-support/…falla critica di “iniezione di codice” nel SAP Solution Manager rappresenta un rischio elevato per l’integrità dei sistemi aziendali, con un indice di gravità molto vicino al massimo.

Questa vulnerabilità, che vanta un punteggio CVSS pari a 9,9, viene etichettata come “Critica”. La sua origine risiede nell’assenza di una corretta sanificazione degli input, ciò che permette ad un utente malintenzionato, una volta autenticato, di eseguire del codice dannoso attraverso la richiamata di un modulo di funzione che può essere abilitato da remoto.

In questa collection di fix emergono altre due note critiche:

• Vulnerabilità di Apache Tomcat in Commerce Cloud: SAP ha corretto diverse vulnerabilità che interessano Apache Tomcat in SAP Commerce Cloud. Queste falle , tra cui CVE-2025-55754, hanno un punteggio CVSS critico di 9,6.
• Deserializzazione in jConnect: è stata corretta una vulnerabilità di deserializzazione ad alto rischio nell’SDK SAP jConnect per ASE. Questa falla (CVE-2025-42928), classificata CVSS 9.1, poteva consentire a un utente privilegiato di avviare l’esecuzione di codice remoto in condizioni specifiche.

Una delle preoccupazioni più significative è rappresentata dal CVE-2025-42880, una falla di sicurezza di tipo Code Injection che interessa SAP Solution Manager, soprattutto nella versione ST 720.

La compromissione della riservatezza, dell’integrità e della disponibilità potrebbe essere totale se un aggressore ottenesse il pieno controllo del sistema grazie a uno sfruttamento efficace. Le conseguenze sarebbero infatti molto serie.

Oltre agli avvisi critici, sono stati affrontati diversi problemi di elevata gravità:

• Esposizione di dati sensibili (CVE-2025-42878): è stato scoperto che SAP Web Dispatcher e Internet Communication Manager (ICM) possono potenzialmente esporre le interfacce di test interne. Se lasciati abilitati, gli aggressori non autenticati potrebbero “accedere alla diagnostica, inviare richieste contraffatte o interrompere i servizi”.
• Denial of Service (DoS): sono state corrette due vulnerabilità DoS separate (CVE-2025-42874 e CVE-2025-48976): una in SAP NetWeaver (servizio remoto per Xcelsius) e l’altra in SAP Business Objects.
• Corruzione della memoria (CVE-2025-42877): è stato risolto anche un difetto di corruzione della memoria che interessava Web Dispatcher, ICM e SAP Content Server.

E’ fortemente consigliato che gli amministratori esaminino e implementino queste patch, soprattutto la correzione critica per Solution Manager, al fine di assicurare che i loro ambienti SAP continuino a essere protetti anche nel corso del 2026.

L'articolo SAP Solution Manager: risolta una falla critica di con Severity CVSS da 9.9 proviene da Red Hot Cyber.

#OpenAI #Codex CLI war angreifbar - da hätte man alles rausziehen und unterjubeln können.

https://www.borncity.com/blog/2025/12/09/kritische-sicherheitsluecke-cve-2025-61260-in-openai-codex-cli/

🚨 CRITICAL: Fortinet, Ivanti, SAP patch auth bypass & code exec flaws (e.g. CVE-2025-59718, CVE-2025-10573, CVE-2025-42880). Affects FortiOS, FortiWeb, Ivanti Endpoint Manager, SAP Solution Manager. Patch ASAP & disable risky features! https://radar.offseq.com/threat/fortinet-ivanti-and-sap-issue-urgent-patches-for-a-9a0f9a74 #OffSeq #Vulnerability #SysAdmin