VulnHub

Real-time Cybersecurity News

React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors

The Hacker News
Actively Exploited
LinuxVulnerabilityMalwarePalo AltoIntel

Overview

The React2Shell vulnerability is currently being exploited by cybercriminals to install malware on Linux systems. Researchers from Palo Alto Networks and NTT Security have identified that this vulnerability facilitates the deployment of malicious tools like KSwapDoor and ZnDoor. KSwapDoor is particularly concerning as it is a sophisticated remote access tool designed to operate stealthily, allowing attackers to maintain control over compromised systems without detection. This ongoing threat affects organizations running vulnerable Linux environments, making it crucial for them to take immediate action to secure their systems. Users need to be aware of the risks and ensure their defenses are updated to mitigate potential attacks.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Linux systems running vulnerable software, specifically those affected by the React2Shell vulnerability.
  • Action Required: Organizations should apply security patches and updates as soon as they are available for the affected systems.
  • Timeline: Newly disclosed

Original Article Summary

The security vulnerability known as React2Shell is being exploited by threat actors to deliver malware families like KSwapDoor and ZnDoor, according to findings from Palo Alto Networks Unit 42 and NTT Security. "KSwapDoor is a professionally engineered remote access tool designed with stealth in mind," Justin Moore, senior manager of threat intel research at Palo Alto Networks Unit 42, said in a

Impact

Linux systems running vulnerable software, specifically those affected by the React2Shell vulnerability.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should apply security patches and updates as soon as they are available for the affected systems. Regularly review and strengthen security configurations to prevent exploitation. Implementing network monitoring and intrusion detection systems can help identify and mitigate any unusual activities associated with this vulnerability.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, Vulnerability, Malware, and 2 more.

Read Original Article

Related Coverage

Palo Alto Networks launches AI safety toolkit for schools

SCM feed for Latest

Palo Alto Networks has launched a free digital literacy toolkit in collaboration with Cyberlite to help educators teach students about AI-driven threats. This initiative aims to combat the rising use of artificial intelligence by cybercriminals, emphasizing the importance of digital literacy in recognizing and resisting such threats.

Dec 3, 2025

WormGPT 4 and KawaiiGPT: New Dark LLMs Boost Cybercrime Automation

SecurityWeek

Palo Alto Networks has identified new malicious language models, WormGPT 4 and KawaiiGPT, that are being utilized by cybercriminals to enhance their phishing, malware development, and reconnaissance efforts. The rise of these dark LLMs represents a significant threat to cybersecurity, automating and streamlining various cybercrime activities.

Nov 25, 2025

​​Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications​

All CISA Advisories

CISA has identified that various cyber threat actors are using commercial spyware to target users of mobile messaging applications, employing tactics such as phishing, zero-click exploits, and impersonation. The focus is primarily on high-value individuals including government and military officials, indicating a serious threat to sensitive communications.

Nov 24, 2025

In Other News: ATM Jackpotting, WhatsApp-NSO Lawsuit Continues, CISA Hiring

SecurityWeek

The article highlights several significant cybersecurity incidents, including a data breach affecting 120,000 individuals and a surge in scanning activities by Palo Alto Networks. Additionally, it mentions ongoing legal battles involving WhatsApp and NSO, as well as the emergence of AI-related security threats such as second-order prompt injection attacks.

Nov 21, 2025

Attackers launch dual campaign on GlobalProtect portals and SonicWall APIs

Security Affairs

A hacking campaign has been targeting GlobalProtect logins and scanning SonicWall APIs since December 2, 2025. The attack is significant due to its scale, involving over 7,000 IP addresses linked to a German hosting provider, indicating a coordinated effort that poses a serious threat to the security of affected systems.

Dec 6, 2025

VVS Stealer, a new python malware steals Discord credentials

Security Affairs

VVS Stealer is a new type of malware written in Python that specifically targets Discord users by stealing their credentials and tokens. Discovered by researchers at Palo Alto Networks, this malware has been available for purchase on Telegram since at least April 2025. The ease of access to this tool poses a significant risk to Discord users, as attackers can use stolen credentials to hijack accounts, potentially leading to further scams or unauthorized activities within the platform. This incident raises concerns about the security measures in place for popular communication tools like Discord, and users are urged to be vigilant about their account security. Protecting accounts with strong, unique passwords and enabling two-factor authentication can help mitigate some of the risks associated with such malware.

Jan 5, 2026