A critical vulnerability named React2Shell has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog following confirmed active exploitation. This flaw affects React2Shell, a component presumably related to React or JavaScript environments, enabling attackers to execute arbitrary code remotely. Although specific affected versions and patch links are not provided, the threat is rated critical due to its exploitation in the wild and potential for severe impact. European organizations using affected React2Shell components are at risk of compromise, data breaches, or service disruption. Mitigation requires immediate identification of vulnerable systems, application of vendor patches once available, and enhanced monitoring for exploitation attempts. Countries with significant technology sectors and high adoption of React-based technologies, such as Germany, France, and the UK, are most likely to be impacted. Given the critical severity, ease of exploitation, and active exploitation status, this vulnerability demands urgent attention from cybersecurity teams across Europe.
CVE-2025-55182, known as React2Shell, is a critical vulnerability in React Server Components affecting React versions 19.x and Next.js versions 15.x and 16.x when using App Router. It has a maximum CVSS score of 10.0. Multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda, rapidly exploited this vulnerability within hours of its public disclosure on December 3, 2025. Public exploit code is available through Metasploit and Exploit-DB, and the vulnerability has been added to the CISA KEV catalog. Fixed versions include React 20.0.0 and Next.js 17.0.0 and later.
The React2Shell vulnerability is a newly disclosed high-severity security flaw currently being actively exploited by Chinese threat actors. Although detailed technical specifics and affected versions are not provided, the exploit is confirmed to be in the wild, indicating immediate risk. This vulnerability likely allows attackers to execute arbitrary code remotely, threatening confidentiality, integrity, and availability of affected systems. European organizations using React2Shell or related software components are at risk, especially those in critical infrastructure and technology sectors. Mitigation is complicated by the lack of official patches or detailed technical guidance, necessitating enhanced monitoring, network segmentation, and rapid incident response readiness. Countries with significant software development industries and critical infrastructure reliant on vulnerable components are most likely to be targeted. Given the active exploitation and potential for severe impact without authentication, the threat severity is assessed as critical. Defenders must prioritize detection of exploitation attempts and implement compensating controls until patches become available.
Microsoft has silently patched a long-standing vulnerability in the Windows LNK file handling mechanism after years of active exploitation. The flaw allowed attackers to execute arbitrary code by tricking users into opening or previewing specially crafted shortcut (. LNK) files, a technique historically used in targeted attacks and malware campaigns. Although Microsoft did not publicly announce the patch initially, the fix addresses a high-severity issue that impacts Windows systems globally. European organizations using Windows are at risk due to the widespread use of the OS and the potential for this exploit to be used in spear-phishing or supply chain attacks. The vulnerability affects the confidentiality, integrity, and availability of affected systems by enabling remote code execution without user authentication, often requiring minimal user interaction. Mitigation involves applying the latest Windows updates immediately, disabling the parsing of LNK files in untrusted locations, and enhancing endpoint detection capabilities for suspicious LNK file activity. Countries with high Windows market penetration and significant critical infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. Given the ease of exploitation, the scope of affected systems, and the impact on core security properties, this threat is assessed as high severity. Defenders should prioritize patching and monitoring for related attack indicators to reduce exposure to this stealthy but dangerous vulnerability.
Google has released patches addressing 107 vulnerabilities in the Android operating system, including two critical framework bugs that have been actively exploited in the wild. These flaws affect multiple components of Android, potentially allowing attackers to execute arbitrary code, escalate privileges, or cause denial of service. The vulnerabilities are considered high severity due to their exploitation status and broad impact on Android devices globally. European organizations relying on Android devices face risks including data breaches, device compromise, and operational disruption. Immediate patching is essential to mitigate these threats. Countries with high Android adoption and significant mobile-dependent infrastructure are most at risk. The threat requires no user interaction for exploitation in some cases, increasing its danger. Defenders should prioritize deploying official Google security updates and monitor for indicators of compromise related to these framework bugs. Enhanced mobile device management and network-level protections can further reduce exposure.
Attackers exploit publicly accessible npm metadata scanners like NPMSCan.com to map JavaScript supply chains and identify vulnerable dependencies in frameworks such as Next.js, Nuxt.js, React, and Bun. By leveraging OSINT from package manifests, they can pivot to real exploit paths without accessing source repositories. This technique chains weak npm hygiene, outdated packages, and misconfigured CI pipelines to achieve remote code execution (RCE) on live web applications. Although no known exploits are currently observed in the wild, the threat is rated high severity due to the potential impact and ease of exploitation. European organizations relying on these JavaScript frameworks and npm packages are at risk, especially those with complex CI/CD environments. Mitigation involves improving dependency management, securing CI configurations, and monitoring for suspicious activity related to package metadata exposure. Countries with strong tech sectors and widespread use of these frameworks, such as Germany, France, the UK, and the Netherlands, are more likely to be targeted.
