New telemetry from AWS shows exploit attempts against React2Shell (CVE-2025-55182, CVSS 10) starting within hours of disclosure, coming from infrastructure associated with two long-tracked China-linked clusters. Activity includes discovery commands, file writes, and probing other N-days.

Cloudflare’s brief outage during mitigations further highlights how fast large platforms now respond to critical RCEs.

Source: https://www.bleepingcomputer.com/news/security/react2shell-flaw-exploited-to-breach-30-orgs-77k-ip-addresses-vulnerable/

💬 How do we realistically defend against same-day exploitation?
👍 Follow us for more detailed cyber reports.

#React2Shell #CVE202555182 #CyberSecurity #ThreatIntel #AppSec #WebSecurity #CloudSecurity #InfoSec

~290 unique IPs now for React2Shell opportunistic activity.

These persistent IPs:

- 45[.]61[.]157[.]12
- 144[.]31[.]5[.]11
- 174[.]138[.]2[.]203
- 95[.]214[.]52[.]170
- 192[.]159[.]99[.]95
- 149[.]50[.]96[.]133

are responsible for ~78% (~218K) total React2Shell sessions we've seen since the start.

Moar charts/tables here: https://rud.is/r2s/r2s.html / https://viz.greynoise.io/tags/react-server-components-unsafe-deserialization-cve-2025-55182-rce-attempt?days=10

Najdi pět rozdílů:

https://nvd.nist.gov/vuln/detail/CVE-2025-55182

https://en.wikipedia.org/wiki/Great_Famine_(Ireland)#Potato_dependency

Coreruleset patch to block (some?) CVE-2025-55182 exploit attempts:

https://github.com/coreruleset/coreruleset/pull/4372

#CVE_2025_55182 #modsecurity #coreruleset #react2shell

Mindst 2 stats-aktører udnytter en nyligt afsløret sårbarhed i React-frame-workets server-komponenter.

..begyndte få timer efter, at sårbarheden, CVE-2025-55182 kaldet React2Shell, fra sidste onsdag

.. angriberne brugte anonymiserende proxy-servere og udnyttede andre sårbarheder. Angrebene anvendte private exploits
https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc

Reach2Shell har en enorm indflydelse. Ifølge Stack Overflow-udvikler-undersøgelsen 2025 bruger mere end ½ af web-udviklere React
https://survey.stackoverflow.co/2025/technology

🚨 In this week’s Threat Alert article, we’re tracking the explosive rise of React2Shell (CVE-2025-55182) attacks. The CrowdSec Network has observed 15,725+ signals in 4 days, a single-day peak of 8,925, and 381 unique IPs already weaponizing the flaw.

Read the full analysis and protect your systems 👉 https://www.crowdsec.net/vulntracking-report/cve-2025-55182

#CVE #React2Shell #CVE202555182 #threatalert #cybersecurity

Defer to @todb on this as CVE expert(tm) but shouldn't CVE-2025-66516 have been an update of CVE-2025-54988? It's the same vulnerability.

https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k

🚨 CRITICAL: CVE-2025-27020 hits Infinera MTC-9 (R22.1.1.0275<R23.0). Missing SSH auth lets attackers run commands & access data. Upgrade to R23.0+ and restrict SSH immediately. https://radar.offseq.com/threat/cve-2025-27020-cwe-306-missing-authentication-for--156b66fd #OffSeq #Vulnerability #Infosec #NetworkSecurity

Infinera yikes.

https://www.cve.org/CVERecord?id=CVE-2025-27020

Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system\n\n.\n\n\nThis issue affects MTC-9: from R22.1.1.0275 before R23.0.

and

https://www.cve.org/CVERecord?id=CVE-2025-27019

Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows\n an attacker to utilize password-less user accounts and obtain \nsystem access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.

Turns out I had a Next.js app deployed on a shared hosting setup that got hacked by the recent React Server Components vulnerability (https://nextjs.org/blog/CVE-2025-66478).

It was a generic attack that was not well suited to my setup, so it looks like nothing bad happened, but I’ve had to do some cleanup.

Not my fave thing to do at 11:30 pm for 4 hours straight.

Microsoft har i al stilhed rettet en #0day sårbarhed i Windows LNK-fil-formatet

Sårbarheden, CVE-2025-9491, er blevet udnyttet af 22 hackergrupper siden sidste år

Rettelserne er blevet udrullet i små portioner siden juni

Microsoft afviste oprindeligt at rette problemet, efter at de blev underrettet om angrebene
https://blog.0patch.com/2025/12/microsoft-silently-patched-cve-2025.html

Moved from webp-express to avif-express on my Wordpress site because the former has a security vulnerability (CVE-2025-11379) and looks unmaintained.

#CVE_2025_11379 #webp #avif #wordpress