Operation PCPcat is a large-scale attack campaign targeting Next.js servers by exploiting two remote code execution vulnerabilities identified as CVE-2025-29927 and CVE-2025-66478. Within 48 hours, attackers compromised around 59,000 servers, extracting sensitive configuration and credential files such as .env files, SSH keys, and cloud credentials. They also installed persistent backdoors and operated a command and control infrastructure that was publicly exposed, allowing insight into real-time campaign metrics. The attack chain includes exploitation, data theft, and persistence mechanisms. The campaign poses a medium severity threat with significant potential impact due to the volume of compromised servers and the nature of stolen data. No patch or official vendor advisory details are included in the provided information.

The campaign led to the compromise of approximately 59,000 Next.js servers, resulting in theft of sensitive files (.env, SSH keys, cloud credentials), installation of persistent backdoors, and exposure of a command and control infrastructure. This enables attackers to maintain long-term access and potentially escalate further attacks. The scale and nature of the stolen data could lead to broader security breaches if credentials are reused or cloud environments are accessed. The threat is medium severity based on the provided assessment.

The information advises organizations running Next.js in production to immediately patch vulnerable systems and rotate all potentially compromised credentials. However, no specific patch links or vendor advisories are provided in the data. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Rotating credentials and removing backdoors are critical steps to mitigate ongoing risk. Detection rules and IoCs are reportedly available to assist in identifying compromise.