Critical React2Shell flaw actively exploited in China-linked attacks

**React2Shell (CVE-2025-55182)** is an unauthenticated insecure-deserialization RSC 'Flight' protocol flaw in React/Next.js that allows remote JavaScript execution; public PoCs appeared quickly and AWS observed China-linked threat actors (Earth Lamia, Jackpot Panda) actively exploiting the issue within hours of disclosure, while tooling and scanners (and vendor patches) are available but many deployments remain vulnerable.