Google Warns Multiple Hacker Groups Are Exploiting React2Shell to Spread Malware

Cybersecuritynews •Dhivya • December 13, 2025

Google Threat Intelligence Group (GTIG) has issued a warning regarding the widespread exploitation of a critical security flaw in React Server Components. Known as React2Shell (CVE-2025-55182), this vulnerability allows attackers to take control of servers remotely without needing a password. Since the vulnerability was disclosed on December 3, 2025, Google has observed multiple distinct hacker groups […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Alerts on Exploitation of React2Shell Vulnerability by Hacker Groups Google Threat Intelligence Group has reported the exploitation of a critical security flaw in React Server Components, identified as React2Shell (CVE-2025-55182). This vulnerability enables attackers to remotely control servers without authentication. Multiple hacker groups are actively using this flaw to deploy malware since its disclosure on December 3, 2025. 5 sources 38

Extracted Entities

Google Warns Multiple Hacker Groups Are Exploiting React2Shell to Spread Malware

The full story

Extracted Entities

Attack Types (2)

CVEs (1)

Malware (1)

Platforms (1)