Chinese groups began exploiting the new critical React2Shell vulnerability within hours. The Internet felt it immediately

The newly disclosed critical vulnerability React2Shell (CVE-2025-55182) hit the internet much faster than the security community expected. According to a report from Amazon Web Services (AWS), Chinese state-sponsored groups Earth Lamia and Jackpot Panda began actively exploiting the flaw just a few hours after it was disclosed.

React2Shell allows an attacker to gain remote access to code on the server without authentication – it's a remote code execution (RCE) vulnerability with a maximum severity score of 10.0.

The flaw affects React Server Components in versions:

• 19.0.0
• 19.1.0
• 19.1.1
• 19.2.0

in the react-server-dom-* packages.

The React team released fixes in updates:

• 19.0.1
• 19.1.2
• 19.2.1

Many deployed systems, however, had not yet been updated in the first days after disclosure – which is exactly the window attackers target.

Chinese actors reacted within hours

According to AWS, exploitation attempts were detected by their honeypot infrastructure shortly after disclosure. Analysts recorded attacks from addresses and servers long associated with 'China-nexus' actors Earth Lamia and Jackpot Panda.

Earth Lamia has long targeted:

• financial services,
• logistics,
• universities,
• government institutions in Latin America and the Middle East.

Jackpot Panda is linked, among other things, to supply-chain compromises of the Comm100 software.

Cloudflare: outage during deployment of protective rules

Cloudflare also entered the situation, reporting a significant network outage on December 5. The company confirmed the incident was not caused by an attack but by a misconfiguration in the Web Application Firewall, specifically a change it was deploying as protection against React2Shell and related attacks on React Server Components.

The outage:

• lasted approximately 25 minutes,
• affected roughly 28 % of HTTP traffic,
• resulted in outages of major web services around the world.

The impact on the internet is immediate. React is one of the most widespread frameworks

This is not an academic problem – React is one of the most widely used web frameworks in the world. Any critical issue in its server components has an immediate impact on real services.

Companies should as quickly as possible:

• check whether they are using vulnerable versions of React Server Components,
• deploy the latest security updates,
• monitor logs and attempts at unauthorized code execution,
• shorten the time between vulnerability disclosure and patch deployment.

A new standard: attacks don't come in weeks but within hours

As data from AWS and other security teams show, the speed of Chinese APT groups is setting a new standard: between the disclosure of a vulnerability and real attempts to mass-exploit it there may not be weeks or days, but only hours.