Attackers Exploit React2Shell Vulnerability to Target IT Sector Systems

**Critical active exploitation of CVE-2025-55182 (React2Shell) in react-server-dom packages is enabling remote code execution across multiple sectors; adversaries have rapidly deployed diverse malware (XMRig, Kaiji, RustoBot, Sliver, CrossC2/Cobalt Strike, VShell, EtherRAT), created persistent backdoors and cron/systemd persistence, and used DNS tunneling and SSH key insertion for persistence and exfiltration — organizations must immediately update affected packages (patched versions 19.0.1, 19.1.2, 19.2.1+), rebuild projects, verify lockfiles, and hunt for provided IOCs and unauthorized services.**