Critical React2Shell flaw exploited in ransomware attacks

Researchers observed attackers exploiting the critical React2Shell (CVE-2025-55182) deserialization flaw to gain unauthenticated RCE and deploy Weaxor ransomware within roughly a minute; the intrusions used obfuscated PowerShell to spawn a Cobalt Strike beacon, disable Defender, encrypt files with a '.WEAX' extension, and remove shadow copies and logs, with no lateral movement observed in the reported case.