Operation PCPcat Hacked 59,000+ Next.js/React Servers Within 48 Hours

Cybersecuritynews •Guru Baran • December 24, 2025

A massive credential-theft campaign dubbed PCPcat compromised 59,128 .js servers in under 48 hours. The operation exploits critical vulnerabilities CVE-2025-29927 and CVE-2025-66478, achieving a 64.6% success rate across 91,505 scanned targets. PCPCat scanners, distributed via react.py malware, probe public .js deployments for remote code execution flaws. Attackers use prototype pollution in JSON payloads to inject […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation PCPcat Compromises Over 59,000 Next.js/React Servers Operation PCPcat has compromised 59,128 Next.js and React servers in under 48 hours, exploiting critical vulnerabilities CVE-2025-29927 and CVE-2025-66478. The attackers utilized prototype pollution in JSON payloads to achieve a 64.6% success rate across 91,505 scanned targets, deploying PCPCat scanners via react.py malware. 3 sources 42

Extracted Entities

Operation PCPcat Hacked 59,000+ Next.js/React Servers Within 48 Hours

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Malware (2)

Platforms (2)