Critical

Wide Range of Malware Delivered in React2Shell Attacks

SecurityWeek

December 11, 2025 at 12:12 PM

Actively Exploited

Overview

Cybersecurity experts are reporting a surge in malware attacks exploiting a serious vulnerability in the React library, known as React2Shell. This vulnerability allows attackers to execute code remotely without authentication, putting many applications at risk. React is widely used for building user interfaces, meaning a broad range of developers and companies could be affected. The situation is concerning as it opens the door for various types of malware to be deployed against unsuspecting users. Companies using React should take immediate action to assess their systems and implement security measures to protect against these attacks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: React library versions affected by the React2Shell vulnerability.
Action Required: Developers should update to the latest version of the React library and apply any available security patches.
Timeline: Newly disclosed

Original Article Summary

Cybersecurity companies have been seeing a wide range of malware being delivered in attacks exploiting the critical React vulnerability dubbed React2Shell. A researcher discovered recently that React, the popular open source library for creating application user interfaces, is affected by a critical vulnerability that can be exploited for unauthenticated remote code execution via specially crafted […] The post Wide Range of Malware Delivered in React2Shell Attacks appeared first on SecurityWeek.

Impact

React library versions affected by the React2Shell vulnerability.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Developers should update to the latest version of the React library and apply any available security patches. Regular security audits and code reviews are also recommended to identify and mitigate potential vulnerabilities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability, Malware, Critical.

Read Original Article

Related Coverage

Metabase zero-day exploited to access Framework customer data

Help Net Security

Framework, a company that specializes in repairable laptops, recently faced a data breach due to a zero-day vulnerability in Metabase, a business intelligence tool. Attackers exploited this vulnerability and gained unauthorized access to sensitive customer information, including names, email addresses, phone numbers, physical addresses, and login IP addresses. However, the breach did not compromise payment information or order records. Framework informed affected customers about the incident, emphasizing the importance of safeguarding personal data. This incident raises concerns about the security of business intelligence tools and the potential risks to customer data across various companies that utilize such services.

Aug 10, 2026

Member of The Com sent to prison for blackmail, sextortion

BleepingComputer

A member of an online cybercrime group known as 'The Com' has been sentenced to two years in prison for engaging in blackmail and sextortion against almost 120 victims globally. This individual targeted children and teenagers, exploiting their vulnerabilities for personal gain. The case sheds light on the growing issue of online exploitation and the dangers that young people face in digital spaces. Law enforcement agencies are increasingly focused on tackling such cybercrimes, and this conviction serves as a warning to others involved in similar activities. The incident raises significant concerns about the safety of minors online and underscores the need for improved protective measures.

Aug 10, 2026

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

The Hacker News

Recent research has shown vulnerabilities in passkey systems designed to enhance online security by replacing traditional passwords and resisting phishing attacks. Three separate studies demonstrated methods for bypassing these protections without breaking the underlying cryptography. For instance, attackers were able to exploit signed authentication data exposed by Windows, leverage a cloud-synced passkey system compromised by existing malware on a victim's device, and other techniques. This is concerning for users and organizations relying on passkeys for secure authentication, as it suggests that even advanced security measures can be undermined. As these attacks become more sophisticated, it raises questions about the reliability of passkeys and the need for ongoing vigilance in security practices.

Aug 10, 2026

LexisNexis shuts down services after suspicious activity on servers

BleepingComputer

LexisNexis has taken its Diligence, Metabase API, and Newsdesk services offline due to suspicious activity detected on servers managed by a third-party vendor. The company has not disclosed specific details about the nature of the unusual activity or the vendor involved. This action aims to protect user data and maintain the integrity of their services. Users of these platforms might experience interruptions as LexisNexis investigates the situation. It's crucial for companies that rely on third-party vendors to monitor their security practices closely, as this incident illustrates potential vulnerabilities in external partnerships.

Aug 10, 2026

Valve notifies Steam hardware customers of a data breach

BleepingComputer

Valve has informed its Steam hardware customers in Europe about a data breach that occurred due to a cyberattack on its shipping partner, CEVA Logistics. Hackers accessed sensitive customer information during the breach, although specific details about the type of data stolen have not been disclosed. This incident raises concerns about the security measures in place at third-party logistics providers, which play a crucial role in the supply chain for tech companies. Affected customers are advised to monitor their accounts for any suspicious activity. This breach also highlights the risks associated with outsourcing logistics and the potential vulnerabilities that can arise from relying on external partners for shipping and handling customer data.

Aug 10, 2026

New Jersey, Alabama Join States Targeted in Water Cyberattacks

SecurityWeek

Hackers believed to be linked to Iran have targeted industrial control systems (ICS) at water facilities across at least a dozen states in the U.S., including New Jersey and Alabama. This cyberattack raises serious concerns about the security of critical infrastructure, as these systems are essential for managing water supplies. While specific details on how the hackers gained access have not been disclosed, the incidents indicate a growing trend of cyber threats against vital public services. The implications of such attacks could be severe, potentially disrupting water services and endangering public safety. Authorities are urging water facilities to bolster their cybersecurity measures in response to these incidents.

Aug 10, 2026