Warning: Critical vulnerability in React Server Components can lead to unauthenticated remote code execution (RCE), Patch Immediately!

Critical unauthenticated RCE (React2Shell) affecting React Server Components, react-server-dom packages, and Next.js (CVE-2025-55182 / CVE-2025-66478) is being actively exploited; threat actors use automated scanners to validate RCE and deploy staged PowerShell payloads with AMSI bypass. The report provides observed IOCs and TTPs (PowerShell -enc, DownloadString/IEX, AMSI bypass primitives, specific network/user-agent fingerprints), and issues urgent patching, perimeter-blocking, and detection recommendations.