Back Cybersecuritynews

Hackers Compromised 700+ Next.js Hosts by Exploiting React2Shell Vulnerability

Cybersecuritynews •Abinaya • April 3, 2026

A massive automated credential theft campaign is actively targeting web applications worldwide. Cybersecurity researchers at Cisco Talos have uncovered an operation by a hacker group tracked as UAT-10608, which has already compromised over 700 servers. The attackers are exploiting a critical security flaw known as React2Shell to gain access and steal highly sensitive data. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Automated Credential Harvesting Campaign Targets React2Shell Vulnerability A large-scale automated credential harvesting campaign, tracked as UAT-10608, has compromised at least 766 hosts globally within 24 hours. The attackers exploit the React2Shell vulnerability (CVE-2025-55182), a pre-authentication remote code execution flaw affecting .js applications. This operation utilizes a framework called 'NEXUS Listener' to systematically harvest sensitive data, including usernames, passwords, SSH keys, and cloud tokens. Researchers from Cisco Talos discovered that an exposed web application allowed them to view the harvested data, which included credentials from major services like AWS, Microsoft Azure, and GitHub. The campaign's indiscriminate targeting pattern suggests automated scanning based on host profile data from services like Shodan. Organizations are urged to address this vulnerability promptly to prevent further credential theft. Talos is collaborating with affected service providers to notify victims and mitigate the impact. 14 sources 73

Extracted Entities

Hackers Compromised 700+ Next.js Hosts by Exploiting React2Shell Vulnerability

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)