Multiple Hacker Groups Exploit React2Shell Vulnerability for Malware Deployment, Google Alerts

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Alerts on Exploitation of React2Shell Vulnerability by Hacker Groups Google Threat Intelligence Group has reported the exploitation of a critical security flaw in React Server Components, identified as React2Shell (CVE-2025-55182). This vulnerability enables attackers to remotely control servers without authentication. Multiple hacker groups are actively using this flaw to deploy malware since its disclosure on December 3, 2025. 5 sources 38