Chinese Hackers Have Started Exploiting the Newly Disclosed React2Shell Vulnerability
Summary: Two China-linked groups, Earth Lamia and Jackpot Panda, were observed weaponizing CVE-2025-55182 (CVSS 10.0), a React Server Components flaw allowing unauthenticated remote code execution, within hours of public disclosure; it is fixed in React 19.0.1, 19.1.2, and 19.2.1. AWS's MadPot honeypots tied the attempts to infrastructure historically linked to those actors, with observed commands including whoami, writing /tmp/pwned.txt, and reading /etc/passwd, alongside exploitation of an NUUO Camera flaw (CVE-2025-1338, CVSS 7.3).
Key Takeaway: A maximum-severity flaw went from disclosure to active exploitation by state-nexus actors in hours, and the same scanning infrastructure was working multiple CVEs at once - so the window between patch release and compromise is now measured against adversaries who are already scanning.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-1338CVE-2025-31324CVE-2025-55182
- Related
- CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025CVE-2025-31324: SAP Net Weaver Unrestricted File Upload Vulnerability Known Exploited Vulnerabilities · Apr 29, 2025