New PCPcat Exploiting React2Shell Vulnerability to compromise 59,000+ Servers

Cybersecuritynews •Tushar Subhra Dutta • December 15, 2025

A new malware campaign called PCPcat has successfully compromised more than 59,000 servers in under 48 hours through targeted exploitation of critical vulnerabilities in .js and React frameworks. The malware targets .js deployments by exploiting two critical vulnerabilities, CVE-2025-29927 and CVE-2025-66478, which allow remote code execution without authentication. The attack uses prototype pollution and command […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PCPcat Malware Compromises Over 59,000 Servers via React2Shell Exploit The PCPcat malware campaign has compromised more than 59,000 servers in under 48 hours by exploiting critical vulnerabilities in .js and React frameworks. It specifically targets vulnerabilities CVE-2025-29927 and CVE-2025-66478, enabling remote code execution without authentication through prototype pollution and command execution techniques. 2 sources 42

Extracted Entities

New PCPcat Exploiting React2Shell Vulnerability to compromise 59,000+ Servers

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Malware (2)

Platforms (1)

Vulnerabilities (1)