React2Shell Vulnerability Exploited in the Wild, Analysts Warn

WXA IASC reports rapid weaponization and active exploitation of CVE-2025-55182 (React2Shell), with honeypot captures within ~20 hours of disclosure and sustained scanning targeting Next.js server paths; a single-operator toolkit dubbed ILOVEPOOP is fingerprinted by distinct headers, rotation of User-Agents, and a nine-node scanner infrastructure centered around two Netherlands-hosted IPs (193.142.147.209 and 87.121.84.24), and defenders are advised to patch, hunt for Next.js internal headers and canary IDs, and prioritize exposure reduction and containment.