⚡ Weekly Recap: USB Malware, React2Shell, WhatsApp Worms, AI IDE Bugs & More

Summary: A critical remote code execution flaw in React Server Components, CVE-2025-55182 (CVSS 10.0) and tracked as React2Shell, came under extensive exploitation within hours of disclosure, with Amazon observing attempts from infrastructure tied to Chinese hacking groups Earth Lamia and Jackpot Panda. The Shadowserver Foundation counted 28,964 vulnerable IP addresses as of December 7, 2025, down from 77,664 on December 5, with roughly 10,100 in the U.S., 3,200 in Germany, and 1,690 in China.
Why it matters: A maximum-severity flaw that needs no authentication and no special setup drew exploitation from multiple threat actors within hours, and tens of thousands of internet-facing addresses were still exposed days later.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-36424 CVE-2025-10155 CVE-2025-10156 CVE-2025-10157 CVE-2025-11699 CVE-2025-12106 CVE-2025-13032 CVE-2025-13086 CVE-2025-13372 CVE-2025-13486 CVE-2025-13510 CVE-2025-13654 CVE-2025-13658 CVE-2025-13751 CVE-2025-20386 CVE-2025-20387 CVE-2025-31361 CVE-2025-31649 CVE-2025-33201 CVE-2025-33211 CVE-2025-47151 CVE-2025-48572 CVE-2025-48633 CVE-2025-55182 CVE-2025-59789 CVE-2025-6389 CVE-2025-64460 CVE-2025-64772 CVE-2025-64775 CVE-2025-64983 CVE-2025-66373 CVE-2025-66399 CVE-2025-66412 CVE-2025-66476 CVE-2025-66516 CVE-2025-9491
Related: Google Patches 107 Android Flaws, Including Two Framework Bugs Exploited in the Wild Cyber Risks ·
CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025
CVE-2025-48572: Android Framework Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Dec 02, 2025