Threat Intel
React2Shell Exploitation Surge: Automated Scans Target Vulnerable React Server Components
Over the past 10 days the React2Shell campaign has flooded networks with automated probes against vulnerable React Server Components. Most traffic consists of 200‑500‑byte payloads, indicating scripted scanners, while a minority of 1,000‑byte payloads carry actual malicious code. Defenders should harden React deployments, monitor for these size patterns, and leverage GreyNoise blocklists.
What Happened
In the last week and a half, attackers have launched a high‑volume campaign against React Server Components. The probes are sent in bulk, using the same minimal payload template that wraps simple commands such as whoami or curl in a Node.js/Next.js wrapper.
Impact
Systems running unpatched or misconfigured React Server Components are exposed to automated exploitation attempts. The sheer volume of probes can overwhelm logging and detection systems, and a small subset of larger payloads may deliver crypto‑mining or denial‑of‑service code.
Payload Fingerprint
Analysis of the payload size distribution shows three distinct clusters:
- 200‑500 bytes – automated noise from scanners.
- 150‑400 bytes – minimal templates used for basic probes.
- 1,000+ bytes – sophisticated payloads carrying actual malicious logic.
What to Do
Defenders should:
- Patch or harden React Server Components immediately.
- Implement rate‑limiting and anomaly detection for inbound requests matching the 200‑500 byte pattern.
- Use GreyNoise blocklists to filter known malicious IPs and block repeated probes.
- Log and alert on payload sizes above 1,000 bytes to detect potential exploitation attempts.
Related vulnerabilities
React Server Components Exploitation Consolidates to Two IPs, 56% of Traffic
After CVE-2025-55182 was disclosed, attackers have focused on two IP addresses that now generate the majority of exploitation attempts against React Server Components. The flaw is a CVSS 10.0 pre‑authentication remote code execution that can be triggered with a single HTTP POST. Defenders should patch immediately, block the offending IPs, and monitor for cryptomining or reverse shell activity.
Read briefing
Microsoft Releases Critical Patches for 18 Azure and AI Product Vulnerabilities
Microsoft issued critical patches for 18 vulnerabilities affecting Azure services and Copilot AI products, primarily privilege‑elevation flaws. The fixes are server‑side and no exploitation has been reported. Defenders should update affected components and verify configuration changes.
Read briefing
Microsoft Patch Tuesday: 972 CVEs, 113 Critical, 2 Zero‑Day Exploits – Immediate Patching Urgently Needed
Microsoft’s September 2026 Patch Tuesday saw a massive rollout of 972 security fixes, including 113 critical issues and two zero‑day vulnerabilities that have already been leveraged by threat actors. The patches cover a broad range of products, from Windows Server and Office to Azure services. The most dangerous flaws affect remote desktop, SMB, and kernel components, enabling remote code execution and privilege escalation. Organizations must apply the updates without delay, verify integrity, and monitor for suspicious activity. Failure to patch exposes systems to active exploitation and could
Read briefing
Proxyjacking Campaign Hijacks Edge Devices to Serve Residential Proxies – 143 Devices in 34 Countries
A proxyjacking operation was uncovered by GreyNoise during a live demo, affecting 143 edge devices across 34 countries. The attackers used compromised devices to route traffic through residential IPs, masking malicious activity. Defenders should audit edge device integrity, block identified malicious IPs, and monitor Entra ID sign‑in logs for anomalous residential sources.
Read briefing