CrowdSec: Threat Alert

Here’s a snippet of your Monday report on immediate and emerging threats. Powered by the CrowdSec Network.

CVE-2025-55182: React2shell Now in the Top 3 of Vulnerabilities by Globally Observed Attack
Volume

When we write this newsletter, we try not to discuss the same vulnerability twice in a row. So initially, the plan for this week was to talk about a run-of-the-mill XWiki exploit (a tried and tested strategy); however, after observing the past week of React2Shell exploitation, we think CVE-2025-55182 deserves a good follow-up.

The reason is this: When we published our report on React2Shell last week, we were seeing around 500 distinct attackers each day. Two days later, this number had grown to 5000 attackers each day, with a peak on the 11th of December, when the CrowdSec Network observed over 10,000 distinct attackers using React2Shell.

To help security teams manage this onslaught, we also released a free Blocklist containing all the active IoCs we see targeting CVE-2025-55182. Instructions on how to add it to your stack can be found in the accompanying announcement post.

So this week, we are looking into React2Shell again, talking about what has changed and what has mostly stayed the same.

Key findings

Since our last report, the number of attacking IPs has exploded from 500 to over 10,000 attackers in a single day.
Public Vulnerability Scanners have now picked up the vulnerability, ensuring that attackers have less and less meat to go around.

...