Operation PCPcat Exploits Next.js and React, Impacting 59,000+ Servers

Gbhackers •Divya • December 24, 2025

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation PCPcat Compromises Over 59,000 Next.js/React Servers Operation PCPcat has compromised 59,128 Next.js and React servers in under 48 hours, exploiting critical vulnerabilities CVE-2025-29927 and CVE-2025-66478. The attackers utilized prototype pollution in JSON payloads to achieve a 64.6% success rate across 91,505 scanned targets, deploying PCPCat scanners via react.py malware. 3 sources 42

Extracted Entities

Operation PCPcat Exploits Next.js and React, Impacting 59,000+ Servers

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Platforms (2)