Cloud Attackers Now Prefer Vulnerability Exploits Over Credentials, Google Cloud Finds

Google Cloud's H1 2026 Threat Horizons report warns that in H2 2025 attackers increasingly exploited unpatched third‑party software—accounting for 44.5% of primary entry vectors—rather than relying on weak credentials. The report calls out CVE-2025-55182 (React2Shell), a critical remote code execution in React Server Components, which was rapidly mass-exploited by nation-state-linked actors to deploy crypto-mining malware within 48 hours of disclosure, and recommends automated defenses (WAF patching, centralized identity controls, automated posture enforcement) to mitigate fast-moving exploit campaigns.