Researchers track dozens of organizations affected by React2Shell compromises tied to China’s MSS

Report details active, large-scale exploitation of the critical React2Shell vulnerability (CVE-2025-55182, CVSS 10.0) with widespread scanning and automated attacks observed across millions of internet-facing instances; threat actors tied to China’s MSS have been associated with installing malware (Snowlight, Vshell), attempting credential and AWS configuration theft, and security agencies (FBI, CISA) have urged immediate patching and targeted hunting.