CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The Grey Noise Observation Grid Is Seeing So Far
Summary: GreyNoise's Observation Grid has recorded over 8.1 million attack sessions exploiting CVE-2025-55182, the React Server Components 'Flight' protocol unauthenticated RCE known as React2Shell, with daily volumes stabilizing at 300,000-400,000 after peaking above 430,000 in late December. The campaign spans 8,163 unique source IPs across 1,071 ASNs in 101 countries, has produced over 70,000 unique payloads, and shows a slow migration of the CVE into Mirai and other botnet exploitation kits.
Why it matters: Amazon Web Services alone accounts for over a third of observed exploitation traffic, and nearly 50% of the source IPs were first seen in December 2025 - so static blocklists built on last month's addresses are already stale against an 8,000-IP footprint that rotates through VPS and proxy pools.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-55182
- Related
- CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025