This threat involves exploitation of two remote code execution vulnerabilities in Next.js (CVE-2025-29927 and CVE-2025-66478) that enabled attackers to compromise about 59,000 servers in 48 hours. The attackers extracted sensitive configuration and credential files, installed persistent backdoors, and maintained a publicly accessible command and control infrastructure. The campaign, named Operation PCPcat, demonstrates a coordinated effort to steal credentials and maintain long-term access to compromised servers. No patch links or vendor advisories are provided in the source data. The threat is currently assessed as medium severity.

The impact includes unauthorized access to sensitive files such as environment configuration files, SSH keys, and cloud credentials, which can lead to further compromise of infrastructure and data exfiltration. Persistent backdoors allow attackers ongoing control of affected servers. The scale of compromise (59,000 servers) indicates a widespread impact. European organizations may face increased risk based on the advisory information.

The source advises immediate patching of vulnerable Next.js systems and rotation of all potentially compromised credentials. However, no specific patch or vendor advisory is provided in the data. Patch status is not yet confirmed—check the official vendor advisory for current remediation guidance. Organizations should prioritize credential rotation and investigate for signs of backdoors or unauthorized access.