Exploited React2Shell Flaw By LLM-generated Malware Foreshadows Shift in Threat Landscape 

Security researchers observed an AI/LLM-generated malware sample exploiting the React2Shell vulnerability to abuse an exposed Docker daemon in a Darktrace honeypot, where the attacker launched a "python-metrics-collector" container, installed tooling, retrieved Python packages, and executed an obfuscated Python payload; spreader logic appeared separate, with activity linked to IP 49.36.33.11. The report underscores how LLMs lower the barrier for building end-to-end intrusion chains and urges defenders to harden exposed services, adopt runtime and anomaly-based detections, and integrate deception technologies as AI-enabled threats accelerate.