React2Shell Under Active Exploitation by China-Nexus Hackers

Critical pre-auth RCE (CVE-2025-55182, "React2Shell") in React Server Components is being actively exploited: AWS attributes exploitation attempts to state-linked groups Earth Lamia and Jackpot Panda, while scanners and proof-of-concept exploits (some inaccurate or malicious) have rapidly proliferated. Shadowserver and Censys report from tens of thousands to over 2.15 million potentially affected internet-facing instances, and mitigation efforts have already caused operational impact (e.g., Cloudflare failures).