InfoSecBulletin Cybersecurity for mankind
More than 77,000 IP addresses online are at risk from the serious React2Shell remote code execution flaw (CVE-2025-55182). Researchers report that attackers have already breached over 30 organizations in various sectors.
React2Shell is a vulnerability that allows unauthorized remote code execution with just one HTTP request. It affects all frameworks using React Server Components, including Next.js, due to shared deserialization logic.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
On December 4, security researcher Maple3142 released a proof-of-concept for remote command execution on unpatched servers. This prompted rapid scanning for the vulnerability, as both attackers and researchers utilized the public exploit with automation.
Over 77,000 vulnerable IP addresses:
The Shadowserver Foundation has found 77,664 IP addresses at risk due to the React2Shell flaw, including about 23,700 in the U.S.
Researchers found that IP addresses were exposed to vulnerabilities through a detection method by Searchlight Cyber/Assetnote, which involved sending an HTTP request to servers to exploit a flaw and checking the response to confirm device vulnerability.
GreyNoise detected 181 unique IP addresses trying to exploit the flaw in the last 24 hours, mainly from automated traffic. Most scans come from the Netherlands, China, the United States, Hong Kong, and a few other countries.
Palo Alto Networks reveals that over 30 organizations have been affected by the React2Shell flaw, allowing attackers to run commands, gather information, and try to steal AWS configuration and credential files.
These compromises include intrusions linked to known state-associated Chinese threat actors.
Companies globally have quickly installed the patch and applied fixes for the serious React flaw.
Yesterday, Cloudflare roll out emergency measures for the React flaw in its Web Application Firewall (WAF) because of its serious exploitation.
However, the update inadvertently caused an outage affecting numerous websites before the rules were corrected.
CISA included CVE-2025-55182 in the Known Exploited Vulnerabilities catalog, mandating federal agencies to patch it by December 26, 2025, per Binding Operational Directive 22-01.
Organizations using React Server Components or related frameworks should update immediately, rebuild and redeploy their applications, and check logs for PowerShell or shell command activity.
