China, Iran are having a field day with React2Shell, Google warns

Google and other vendors report widespread, immediate exploitation of a critical React Server Components RCE (CVE-2025-55182, aka React2Shell) by multiple nation-state-linked groups (several China-nexus UNC clusters, North Korea, Iran-linked actors) and criminal operators; attackers have deployed backdoors (Snowlight, Hisonic, Compood, Angryrebel.Linux), tunnelers (Minocat), and XMRig miners across cloud and VPS infrastructure. Additional React vulnerabilities were disclosed, and defenders are advised to patch, monitor outbound wget/cURL activity from web processes, hunt for hidden directories and altered shell configs, and watch the IOCs published by Google.