Vulnerabilities
React Server Components Exploitation Consolidates to Two IPs, 56% of Traffic
After CVE-2025-55182 was disclosed, attackers have focused on two IP addresses that now generate the majority of exploitation attempts against React Server Components. The flaw is a CVSS 10.0 pre‑authentication remote code execution that can be triggered with a single HTTP POST. Defenders should patch immediately, block the offending IPs, and monitor for cryptomining or reverse shell activity.
What happened
Two months after the disclosure of CVE-2025-55182, exploitation of React Server Components has concentrated on two IP addresses, accounting for 56% of all observed attack traffic in the last week.
Impact
The CVE is a CVSS 10.0 pre‑authentication remote code execution flaw that can be triggered with a single HTTP POST. GreyNoise telemetry shows the two IPs are actively deploying cryptomining binaries and opening reverse shells to the scanner IP, not merely scanning.
What to do
Patch all installations of React Server Components immediately. Add the two offending IPs to your firewall or GreyNoise Block list. Monitor logs for unexpected outbound connections to cryptomining staging servers or reverse shell activity. Use the GreyNoise IOC package to detect and block related infrastructure.
Related vulnerabilities
Hitachi Energy REB500: CVE‑2024‑8176 & CVE‑2025‑59375 Enable DoS via IEC61850
Hitachi Energy REB500 versions ≤8.3.3.1 suffer two libexpat flaws (CVE‑2024‑8176 and CVE‑2025‑59375) that can be leveraged by authenticated users to trigger a denial‑of‑service. The vendor has released a patch to 8.3.4.0; operators should update immediately and monitor IEC61850 traffic.
Read briefing
CVE‑2025‑50165: Critical Windows Imaging Component RCE via Crafted JPEG
Microsoft’s WindowsCodecs.dll contains CVE‑2025‑50165, a critical flaw that can trigger remote code execution when a specially crafted JPEG is processed. The vulnerability is in the jpeg_finish_compress routine, and while Microsoft rates it critical, exploitability is considered low. Defenders should apply the latest Windows updates, disable unnecessary image processing on servers, and monitor for anomalous JPEG handling.
Read briefing
CVE-2025-48927: TeleMessage SGNL Heapdump Leak Vulnerability Remediated, No Exploitation Detected
TeleMessageTM SGNL, an enterprise messaging platform, suffered a CVE-2025-48927 flaw that exposed a public /heapdump endpoint, potentially leaking 150 MB of heap memory containing plaintext credentials. The issue was fully remediated in early May 2025, with independent verification and no customer action required. Defenders should confirm their deployments are patched, disable actuator endpoints, and monitor GreyNoise feeds for related reconnaissance activity.
Read briefing
TrendAI Apex One Local Privilege Escalation via Incomplete Cleanup (CVE-2025-71414)
A local privilege escalation flaw in TrendAI Apex One Security Agent allows attackers who can run low‑privileged code to gain SYSTEM rights by exploiting improper cleanup in the TmccCore component. The CVE‑2025‑71414 vulnerability has a CVSS score of 7.8. Defenders should patch immediately and monitor for suspicious process termination events.
Read briefing