InfoSecBulletin Cybersecurity for mankind
More than 77,000 IP addresses online are at risk from the serious React2Shell remote code execution flaw (CVE-2025-55182). Researchers report that attackers have already breached over 30 organizations in various sectors.
React2Shell is a vulnerability that allows unauthorized remote code execution with just one HTTP request. It affects all frameworks using React Server Components, including Next.js, due to shared deserialization logic.
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
On December 4, security researcher Maple3142 released a proof-of-concept for remote command execution on unpatched servers. This prompted rapid scanning for the vulnerability, as both attackers and researchers utilized the public exploit with automation.
Over 77,000 vulnerable IP addresses:
The Shadowserver Foundation has found 77,664 IP addresses at risk due to the React2Shell flaw, including about 23,700 in the U.S.
Researchers found that IP addresses were exposed to vulnerabilities through a detection method by Searchlight Cyber/Assetnote, which involved sending an HTTP request to servers to exploit a flaw and checking the response to confirm device vulnerability.
GreyNoise detected 181 unique IP addresses trying to exploit the flaw in the last 24 hours, mainly from automated traffic. Most scans come from the Netherlands, China, the United States, Hong Kong, and a few other countries.
Palo Alto Networks reveals that over 30 organizations have been affected by the React2Shell flaw, allowing attackers to run commands, gather information, and try to steal AWS configuration and credential files.
These compromises include intrusions linked to known state-associated Chinese threat actors.
Companies globally have quickly installed the patch and applied fixes for the serious React flaw.
Yesterday, Cloudflare roll out emergency measures for the React flaw in its Web Application Firewall (WAF) because of its serious exploitation.
However, the update inadvertently caused an outage affecting numerous websites before the rules were corrected.
CISA included CVE-2025-55182 in the Known Exploited Vulnerabilities catalog, mandating federal agencies to patch it by December 26, 2025, per Binding Operational Directive 22-01.
Organizations using React Server Components or related frameworks should update immediately, rebuild and redeploy their applications, and check logs for PowerShell or shell command activity.
