Explore

Rapid Read Rapid Read
React2Shell Vulnerability Exploited by North Korean Hackers, Says Sysdig

React2Shell Vulnerability Exploited by North Korean Hackers, Says Sysdig

Cybersecurity firm Sysdig has linked the exploitation of the React2Shell vulnerability to North Korean threat actors. The vulnerability, identified as CVE-2025-55182, affects version 19 of the React open source library and related frameworks like Next.js and Waku. It allows for unauthenticated remote code execution, posing a significant threat to applications using these technologies. The Shadowserver Foundation has identified approximately 70,000 vulnerable systems. Sysdig's analysis revealed that the attacks involve sophisticated techniques, including the deployment of EtherRAT, a persistent access implant. The attacks are believed to be part of a campaign similar to the North Korea-linked Contagious Interview, which targets individuals in the cryptocurrency sector.
Rapid Read Rapid Read
North Korean Hackers Exploit React2Shell Vulnerability, Targeting Cryptocurrency

North Korean Hackers Exploit React2Shell Vulnerability, Targeting Cryptocurrency

Cybersecurity firm Sysdig has identified North Korean threat actors exploiting a vulnerability known as React2Shell, officially tracked as CVE-2025-55182, which affects version 19 of the React open source library. This vulnerability allows for unauthenticated remote code execution and has been used to deploy malware such as EtherRAT. The attacks have been linked to the DPRK-affiliated BeaverTail malware, previously used in campaigns targeting individuals in the cryptocurrency and blockchain sectors. The exploitation of React2Shell began shortly after the vulnerability was disclosed on December 3, with attacks involving AWS credential theft and cryptocurrency mining.
Rapid Read Rapid Read
React2Shell Vulnerability Exploited by Cybercriminals, Impacting Numerous Organizations

React2Shell Vulnerability Exploited by Cybercriminals, Impacting Numerous Organizations

A critical vulnerability in the React library, known as React2Shell, is being actively exploited by cybercriminals. This vulnerability, officially tracked as CVE-2025-55182, affects systems using React version 19, particularly those with React Server Components. The flaw allows for unauthenticated remote code execution through specially crafted HTTP requests. Major cybersecurity firms have reported a surge in attacks, with Chinese threat actors initially exploiting the vulnerability. The attacks have led to the delivery of various malware types, including cryptocurrency miners and cloud credential theft tools. Notably, North Korea-linked actors have used the vulnerability to deploy persistent access implants like EtherRAT. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging federal agencies to address it promptly.
Rapid Read Rapid Read
React2Shell Vulnerability Exploitation Surges, Affecting Over 50 Organizations

React2Shell Vulnerability Exploitation Surges, Affecting Over 50 Organizations

A critical vulnerability known as React2Shell in React Server Components has led to a surge in cyberattacks, affecting more than 50 organizations globally. The Cybersecurity and Infrastructure Security Agency has expedited the deadline for patching the vulnerability to mitigate risks. The vulnerability, identified as CVE-2025-55182, has been exploited by various threat actors, including nation-state attackers and cybercriminals. The attacks have targeted organizations across multiple sectors, including financial services, technology, and government. The vulnerability affects several React frameworks and bundlers, making it a widespread issue. Security experts have compared the React2Shell defect to the Log4Shell exploit, noting its potential for significant impact.
Rapid Read Rapid Read
European Commission Partners with Capgemini and Others for Cybersecurity Enhancement

European Commission Partners with Capgemini and Others for Cybersecurity Enhancement

The European Commission has selected a consortium, including Capgemini, Airbus Protect, PwC, and Nviso, to enhance cybersecurity for 71 European institutions. This partnership is part of the MC17 FREIA Cyber Framework Contract, a significant digital protection initiative. The contract, valued at several million euros, spans four years and covers incident management, governance and risk, and training and technical expertise. The consortium aims to improve the resilience of European institutions, address evolving threats, and support digital transformation initiatives. They will also assist in implementing key cybersecurity regulations such as the NIS2 Directive and the Digital Operational Resilience Act.
Trendline Trendline
General Services Administration Secures 65% Discount on Cloud Security Tools with Tenable Agreement

General Services Administration Secures 65% Discount on Cloud Security Tools with Tenable Agreement

General Services Administration Secures 65% Discount on Cloud Security Tools with Tenable Agreement
Rapid Read Rapid Read
Quantum Mechanics Enables Truly Random Number Generation for Secure Digital Applications

Quantum Mechanics Enables Truly Random Number Generation for Secure Digital Applications

Researchers have developed a method to generate truly random numbers using quantum mechanics, a breakthrough that could enhance digital security and fairness. The Colorado University Randomness Beacon (CURBy) is the world's first publicly accessible source of traceable, verifiable random numbers. This system leverages quantum entanglement, a phenomenon where particles become interconnected in such a way that the state of one instantly influences the state of another, regardless of distance. CURBy uses this principle to produce random numbers that are essential for secure digital communications, such as secure web connections and password generation. The randomness is verified through a distributed process involving multiple institutions, ensuring that no single entity can manipulate the outcome.
Rapid Read Rapid Read
Gogs Self-Hosted Git Instances Under Attack Due to Zero-Day Vulnerability

Gogs Self-Hosted Git Instances Under Attack Due to Zero-Day Vulnerability

A zero-day vulnerability in Gogs, a self-hosted Git service, is being actively exploited, affecting over 700 instances. The flaw, identified as CVE-2025-8110, allows attackers to execute remote code by exploiting symbolic links, a method not accounted for in previous patches. This vulnerability was discovered by Wiz researchers during an investigation into malware on an infected machine. The Gogs maintainers have been informed and are working on a fix, but exploitation continues. The vulnerability affects Gogs servers running version 0.13.3 or earlier with open-registration enabled, which is the default setting.
Rapid Read Rapid Read
React2Shell Vulnerability Exploited by China-Linked Hackers

React2Shell Vulnerability Exploited by China-Linked Hackers

The React2Shell vulnerability, identified as CVE-2025-55182, is currently being exploited by threat actors linked to Chinese state interests. This critical vulnerability, with a CVSS v3.1 score of 10, affects React Server Components versions 19.0.0 to 19.2.0. Amazon Web Services (AWS) has confirmed that groups such as Earth Lamia and Jackpot Panda are actively exploiting this flaw. These groups are known for targeting sectors like financial services, logistics, and government organizations across various regions. Over 2.15 million internet-facing services are potentially affected, with several proof-of-concept exploits already in circulation. The vulnerability allows for pre-authentication remote code execution, posing a significant threat to affected systems.
Trendline Trendline
Red Canary's Keith McCammon Discusses Cybersecurity Threats and Leadership Challenges

Red Canary's Keith McCammon Discusses Cybersecurity Threats and Leadership Challenges

Red Canary's Keith McCammon Discusses Cybersecurity Threats and Leadership Challenges
Trendline Trendline
Red Canary's Keith McCammon Discusses Cybersecurity Leadership and Challenges

Red Canary's Keith McCammon Discusses Cybersecurity Leadership and Challenges

Red Canary's Keith McCammon Discusses Cybersecurity Leadership and Challenges
Rapid Read Rapid Read
Cybersecurity Researchers Uncover New Android Malware Families Targeting Banking Users

Cybersecurity Researchers Uncover New Android Malware Families Targeting Banking Users

Cybersecurity researchers have identified two new Android malware families, FvncBot and SeedSnatcher, along with an upgraded version of ClayRat. These malware variants are designed to target mobile banking users, particularly in Poland, by masquerading as legitimate security apps. FvncBot, developed from scratch, employs techniques such as keylogging, web-inject attacks, and screen streaming to commit financial fraud. It abuses Android's accessibility services to gain elevated privileges and exfiltrate sensitive data. SeedSnatcher, distributed via Telegram, focuses on stealing cryptocurrency wallet seed phrases and intercepting SMS messages for two-factor authentication codes. ClayRat has been enhanced to exploit accessibility services and default SMS permissions, making it a potent threat capable of full device takeover.