InfoSecBulletin Cybersecurity for mankind
Hackers are misusing React2Shell flaw in Next.js apps to carry out an automatic scheme to steal credentials. This has already affected at least 766 servers in less than 24 hours.
The threat activity is tracked as “UAT‑10608”. It relies on a custom framework dubbed NEXUS Listener to systematically harvest and organize stolen secrets at scale.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Cisco Talos calls UAT‑10608 a big, automatic campaign that steals login info. It focuses on public Next.js apps that have a weakness called CVE‑2025‑55182, also known as React2Shell.
By linking this pre-authentication remote code execution (RCE) weakness with automated tools used after a breach, the attackers steal passwords, SSH keys, cloud tokens, and secret information without needing more manual work after the first break-in.
Telemetry from an open NEXUS Listener shows at least 766 affected hosts in different areas and cloud services, with the tools set up for wide usage instead of focusing on certain industries.
React2Shell exploitation
React2Shell (CVE‑2025‑55182) is a security flaw with a score of 10.0. It allows attackers to run their code without proper access in React Server Components (RSC). This issue also affects other frameworks that use RSC, like Next.js.
The flaw comes from unsafe deserialization of data from an attacker sent to Server Function points. This lets the attacker run any code they want on the server side in the Node.js process before checking who they are or doing any proper validation.
In this campaign, UAT‑10608 finds a vulnarable internet app. It then sends a special message to a Server Function to cause the deserialization issue.
Successful exploitation results in the execution of a lightweight dropper, which in turn retrieves and launches a multi‑phase shell script without any need for valid credentials.
