InfoSecBulletin Cybersecurity for mankind
A financially motivated ransomware gang exploited React2Shell vulnerability (CVE-2025-55182) to quickly access corporate networks and deploy malware less than a minute later.
React2Shell (CVE-2025-55182) is a maximum severity vulnerability in React Server Components (RSC) which was publicly disclosed on 3 December 2025. The vulnerability impacts the Flight Protocol, a core feature of the React web development library and the open-source framework Next.js, which is used to speed up web application rendering.
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Researchers at S-RM noted the use of React2Shell in an attack on December 5, where a threat actor deployed the Weaxor ransomware.
Weaxor ransomware attack:
Weaxor ransomware emerged in late 2024 and is thought to be a rebrand of the Mallox/FARGO operation, also known as ‘TargetCompany’, which targeted MS-SQL servers.
Weaxor, similar to Mallox, is a basic operation that attacks public servers with opportunistic demands for low ransoms.
S-RM researchers indicate that the threat actor used the encryptor soon after gaining access via React2Shell. This implies an automated attack, but there’s no evidence in the compromised environment to back this up.
Immediately after the breach, the hackers executed an obfuscated PowerShell command that deployed a Cobalt Strike beacon for command and control (C2) communication.
The attacker quickly disabled Windows Defender’s real-time protection and launched the ransomware, all within a minute of gaining access.
The researchers found that the attack was restricted to one vulnerable endpoint, with no signs of lateral movement.
After encryption, the files had the ‘.WEAX’ extension, and every impacted directory had a ransom note file named ‘RECOVERY INFORMATION.txt’, which contained payment instructions from the attacker.
S-RM reported that Weaxor deleted volume shadow copies to hinder restoration and erased event logs to complicate forensic analysis.
The researchers noted that the same host was also attacked by other hackers with different methods, highlighting the extent of malicious activity related to React2Shell.
S-RM recommends that system administrators check Windows event logs and EDR telemetry for signs of process creation from Node or React binaries, as patching by itself is insufficient.
Process spawning of cmd.exe or powershell.exe from node.exe is a strong indicator of React2Shell exploitation Unusual outbound connections, disabled security solutions, log clearing, and resource spikes should also be thoroughly investigated.
