Rapid Exploitation of Vulnerabilities in 2025: Insights from Cisco Talos

• •Attackers are exploiting vulnerabilities faster than ever, with React2Shell as a prime example.
• •Phishing attacks accounted for 40% of intrusion cases, utilizing sophisticated tactics.
• •AI is increasingly being leveraged by cybercriminals to improve attack methods.

In 2025, Cisco's Talos reported a significant increase in the speed at which cybercriminals exploit vulnerabilities, particularly highlighting the React2Shell vulnerability disclosed in December 2025, which became the most-targeted vulnerability shortly after its release. Attackers have focused on identity control points, compromising systems like VPNs and application discovery controllers to facilitate lateral movement and bypass multi-factor authentication (MFA). Phishing remains a prevalent attack vector, with 40% of intrusion cases starting from successful phishing attempts, often utilizing sophisticated messages that mimic legitimate communications. The report also noted that AI is increasingly being used to enhance the effectiveness of cyberattacks, with predictions that it will become integral to cybercrime software. Talos emphasized the need for organizations to strengthen MFA policies and enhance anti-phishing training to combat these evolving threats.