Attackers hit React defect as researchers quibble over proof

A critical RCE deserialization flaw in React Server Components (React2Shell, CVE-2025-55182, CVSS 10) was patched publicly and quickly weaponized: multiple vendors and researchers report widespread scanning, active exploitation, and follow-on activity including credential theft, webshell deployment, cryptojacking, and downloader installations; evidence points to opportunistic criminal groups and state-linked actors (including UNC5174 and China-nexus groups), with CISA adding the CVE to its known exploited vulnerabilities catalog and dozens of organizations confirmed impacted.