Back Cybersecuritynews

Hackers Exploiting React Native’s Metro Server in the Wild to Attack Developers

Cybersecuritynews •Guru Baran • February 3, 2026

Threat actors are actively exploiting a critical remote code execution vulnerability in React Native’s Metro Development Server to deliver advanced malware payloads across Windows and Linux systems. VulnCheck’s Canary honeypot network first detected operational exploitation of CVE-2025-11953 dubbed “Metro4Shell” on December 21, 2025, with continued attacks observed in January 2026, yet the vulnerability remains largely […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hackers Exploit React Native Metro Vulnerability to Target Developers Hackers are exploiting the critical vulnerability CVE-2025-11953 in the Metro server for React Native, affecting developers on Windows, Linux, and macOS. The vulnerability allows unauthenticated attackers to execute arbitrary OS commands on Windows and run arbitrary executables on Linux and macOS with limited control. This poses a significant risk to development environments using React Native. 14 sources 57

Extracted Entities

Hackers Exploiting React Native’s Metro Server in the Wild to Attack Developers

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

CVEs (1)

Platforms (2)