Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

React/Next.js applications React2Shell RCE flaw (CVE-2025-55182)

Vulnerability
First reported
Last updated
Happening score
H score 54
3 unique sources, 5 articles

Summary

Hide ▲

React2Shell (CVE-2025-55182) has been repeatedly exploited against React Server Components (RSC) and Next.js systems, with Huntress saying the first attempt it saw came on December 4, 2025 and led to shells, miners, and malware including PeerBlight, CowTunnel, and ZinFoq. Researchers later tied a TeamPCP worm campaign around December 25, 2025 to exposed Docker APIs, Kubernetes clusters, Ray dashboards, Redis servers, and vulnerable React/Next.js apps used to seed malicious cloud infrastructure. In February 2026, an unknown possibly state-sponsored actor used ILovePoop to probe tens of millions of IPs for exposed systems, while Google said new flaws are weaponized within days and cryptominers can appear within 48 hours. Cisco Talos then reported UAT-10608 running a global credential-theft campaign against public-facing Next.js apps, compromising at least 766 hosts and harvesting credentials, SSH keys, cloud tokens, and environment secrets.

Related Happenings

Magento exploitation wave for CVE-2026-45247

Exploitation Wave
H score9 First: 04.06.2026 10:19 Last: 04.06.2026 10:19 Sources 1

About this happening: Active exploitation of CVE-2026-45247 is hitting Mirasvit Cache Warmer on Magento stores, with malicious requests carrying serialized PHP payloads that can lead to r...

Open Happening

Gamaredon WinRAR malware chain using GammaPhish, GammaLoad, GammaWorm, and GammaSteel

Malware Activity
H score49 First: 02.06.2026 21:21 Last: 02.06.2026 21:21 Sources 1

About this happening: Gamaredon used WinRAR CVE-2025-8088 in January 2026 to launch GammaPhish, which retrieved GammaLoad VBScript downloaders and set up host fingerprinting and fol...

Latest development: 09.06.2026 15:26

Trend Micro attributes ongoing exploitation of WinRAR CVE-2025-8088 against Ukrainian organizations to Earth Dahu (Gamaredon) and SHADOW-EARTH-066 (UAC-0226). The campaigns use crafted RAR archives with hidden ADS payloads, a decoy PDF, a Startup-folder LNK, and a PowerShell chain via cmd.exe to launch GIFTEDCROOK (result.dll), while Earth Dahu's HTA-to-VBScript chain delivers GammaPhish, GammaLoad, and GammaSteel. The exfiltration path also shifts from Telegram to dedicated C2 servers, and Earth Dahu's use of the flaw is assessed to have remained active through at least April 10, 2026.

Open Happening

JINX-0164 cryptocurrency recruitment-lure campaign

Campaign
H score39 First: 28.05.2026 10:54 Last: 28.05.2026 10:54 Sources 1

About this happening: A JINX-0164 campaign is targeting cryptocurrency firms and developers with LinkedIn recruiter lures, a fake meeting-and-fix workflow, and macOS malware to steal cr...

Open Happening

Shai-Hulud worm clone activity on NPM

Malware Activity
H score69 First: 18.05.2026 12:45 Last: 18.05.2026 12:45 Sources 1

About this happening: The Shai-Hulud malware activity has continued to evolve across the npm supply chain and related developer ecosystems. It first infected npm packages in September 202...

Open Happening

OpenDCIM multi-flaw exploitation wave (CVE-2026-28515, CVE-2026-28516, CVE-2026-28517)

Exploitation Wave
H score46 First: 17.05.2026 14:57 Last: 17.05.2026 14:57 Sources 1

About this happening: openDCIM is seeing an active exploitation wave tied to CVE-2026-28515, CVE-2026-28516, and CVE-2026-28517, with attackers targeting vulnerable installations an...

Open Happening

Timeline

  1. 09.03.2026 23:45 2 articles · 4mo ago

    Google reports rapid exploitation of React2Shell in cloud attacks

    Technical Analysis Update

    Google reports that newly disclosed third-party flaws are increasingly being exploited for initial access to cloud environments, with React2Shell (CVE-2025-55182) and CVE-2025-24893 highlighted as frequent RCE examples. The report says attackers are weaponizing new flaws within days, with cryptominers observed within 48 hours of vulnerability disclosure.

    Show sources
    Open in new tab
  2. 20.02.2026 23:07 1 articles · 4mo ago

    Unknown actor probes global IPs for React2Shell exposure

    Campaign Scope Update

    A possibly state-sponsored actor is using the ILovePoop toolkit to probe tens of millions of IP addresses worldwide for exposed React2Shell/CVE-2025-55182 systems, with apparent interest in government, defense, finance, and industrial organizations, particularly in the United States.

    Show sources
    Open in new tab
  3. 09.02.2026 10:37 2 articles · 5mo ago

    TeamPCP exploits React2Shell in cloud-native infrastructure seeding

    Exploitation Observed

    Around December 25, 2025, TeamPCP's worm-driven activity leveraged exposed Docker APIs, Kubernetes clusters, Ray dashboards, Redis servers, and React2Shell (CVE-2025-55182, CVSS score: 10.0) to seed malicious cloud infrastructure for follow-on exploitation against React/Next.js applications.

    Show sources
    Open in new tab
  4. 09.02.2026 10:37 1 articles · 5mo ago

    Researchers publish TeamPCP cloud-native campaign analysis

    Initial Disclosure

    On 2026-02-09, cybersecurity researchers publicly attributed the campaign to TeamPCP (aka DeadCatx3, PCPcat, PersyPCP, and ShellForce) and described it as a cloud-native cybercrime platform that uses misconfigured Docker APIs, Kubernetes APIs, Ray dashboards, Redis servers, and vulnerable React/Next.js applications to support scanning, proxying, data theft, extortion, and monetization.

    Show sources
    Open in new tab