Half of exposed React servers remain unpatched amid active exploitation

The report details widespread, active exploitation of CVE-2025-55182 (“React2Shell”), a critical RCE in React Server Components and dependent frameworks (e.g., Next.js). Telemetry indicates roughly 50% of internet-facing vulnerable instances remain unpatched, and at least 15 distinct intrusion clusters are observed — ranging from commodity cryptomining operations (Kinsing, C3Pool) to suspected nation-state-linked actors using hands-on-keyboard tooling (Sliver), backdoors (EtherRat, BPFDoor), bespoke injectors, and anti-forensics — enabling rapid, industrialized compromise at scale.