Critical React2Shell flaw actively exploited in China-linked attacks

Look, if you’re running React or Next.js in your SMB setup, wake up fast—China-linked hackers like Earth Lamia and Jackpot Panda are already smashing through the critical React2Shell vulnerability (CVE-2025-55182), which lets them run arbitrary JavaScript code on your server without even logging in, all thanks to a sneaky deserialization flaw in the RSC ‘Flight’ protocol. This mess hit the scene just hours after it was disclosed, and with proof-of-concept exploits popping up on GitHub, it’s dead simple for any script kiddie to jump in, potentially exposing thousands of projects across vulnerable versions. Wiz data shows a whopping 39% of cloud environments are sitting ducks, so if you’re an MSP or small biz owner, don’t just patch and pray—grab tools like Assetnote’s React2Shell scanner to quickly check your exposure. Oh, and since these attacks involve real-time tweaking and testing (like probing for user info or dropping files), it’s a stark reminder to lock down your defaults pronto; traditional IAM ain’t cutting it anymore, so treat this as your cue to audit and fortify before the next wave hits.

Source: https://www.bleepingcomputer.com/news/security/react2shell-critical-flaw-actively-exploited-in-china-linked-attacks/