React2Shell exploitation with ransomware and broad probing

Attackers are actively exploiting **CVE-2025-55182** in **React Server Components** and **Next.js** environments. One observed intrusion used the flaw for initial access and deployed **Weaxor ransomware** in less than a minute. The post-exploitation chain included an obfuscated **PowerShell** command, a **Cobalt Strike** beacon, **Windows Defender** tampering, and log clearing. The attacker left **.WEAX** files and **RECOVERY INFORMATION.txt** ransom notes. The same vulnerability has also been used for cyberespionage, malware delivery, and cryptomining, showing that abuse of exposed **React** and **Next.js** systems remains active across multiple threat types. In parallel, a separate exploitation chain used **React2Shell** to drop **EtherRAT**, which resolves C2 through **Ethereum smart contracts** and adds multiple persistence mechanisms. Another set of probes from infrastructure associated with **Earth Lamia** and **Jackpot Panda** attempted **CVE-2025-55182** alongside **CVE-2025-1338** and used discovery commands like **whoami**, `/tmp/pwned.txt`, and `/etc/passwd`. The React team released fixed **React Server Components** package versions on **2025-12-03** for **19.0.1**, **19.1.2**, and **19.2.1**. Related **CVE-2025-55183** fixes address a source-code leak in **react-server-dom-parcel**, **react-server-dom-turbopack**, and **react-server-dom-webpack**, with upgrades to **19.0.3**, **19.1.4**, or **19.2.3**. Operators should patch exposed React deployments and check internet-facing instances for compromise after remediation, but available evidence does not quantify the full reach of exploitation.