For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

F5 Threat Report - December 31st, 2025

Fortinet Warns of 5-Year-Old FortiOS 2FA Bypass Still Exploited in Attacks

Fortinet has issued a warning regarding the continued active exploitation of CVE-2020-12812, a critical FortiOS vulnerability dating back five years. This improper authentication flaw, found in FortiGate SSL VPN, enables threat actors to bypass two-factor authentication (2FA) by manipulating the case of a username. The vulnerability arises from inconsistent case-sensitive matching between local and remote authentication when 2FA is enabled for local users linked to a remote authentication method like LDAP. Fortinet released patches in July 2020 with FortiOS versions 6.4.1, 6.2.4, and 6.0.10, and advised disabling username-case-sensitivity as a workaround. Despite these measures, the flaw is still being exploited, particularly against firewalls with LDAP enabled, under specific conditions where local user entries requiring 2FA are linked to LDAP and belong to an LDAP group configured on the FortiGate. Both the FBI and CISA have previously highlighted the exploitation of CVE-2020-12812 by state-backed hackers and ransomware groups, with CISA adding it to its catalog of known exploited vulnerabilities in November 2021, mandating federal agencies to secure their systems.

Severity: Critical

Sources

Threat Details and IOCs

Malware:Hive, HiveLeaks, Mac.c, MacSync, MacSync Stealer
CVEs:CVE-2020-12812
Technologies:Fortinet FortiGate, Fortinet FortiOS, Microsoft Active Directory
Threat Actors:APT3, APT35, CharmingKitten, CobaltIllusion, CobaltMirage, COBALT MIRAGE, Hive, ImperialKitten, PHOSPHOROUS, Play
Attacker Countries:Iran
Victim Industries:Commercial Facilities, Education, Energy, Financial Services, Government, Healthcare, Information Technology, Manufacturing, Technology Hardware, Telecommunications, Transportation
Victim Countries:Australia, Canada, France, Germany, Italy, Spain, United Kingdom, United States

Mitigation Advice

  • Patch all vulnerable FortiGate firewalls to FortiOS version 6.4.1, 6.2.4, 6.0.10, or a more recent version to remediate CVE-2020-12812.
  • If immediate patching is not feasible, disable username case sensitivity on vulnerable FortiGate firewalls as a temporary workaround to prevent exploitation.
  • Review FortiGate authentication configurations and immediately remove any secondary LDAP groups that are not explicitly required for business operations.

Compliance Best Practices

  • Establish a comprehensive vulnerability management program that includes asset inventory, regular scanning, risk-based prioritization, and defined Service Level Agreements (SLAs) for patching internet-facing systems.
  • Develop and enforce security configuration baselines for all network devices, including FortiGate firewalls. Implement a regular, automated audit process to detect and remediate deviations from these approved baselines.
  • Conduct a strategic review of the remote access authentication architecture to identify and simplify complex integrations, such as those between FortiGate local users and remote LDAP directories, in favor of more robust and less error-prone solutions.

“Headphone Jacking”: Critical Flaws in Airoha Bluetooth SoCs Hijack Phones via Earbuds

A new report from ERNW Enno Rey Netzwerke GmbH details "Headphone Jacking," a series of critical vulnerabilities (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) found in Airoha Bluetooth Systems on a Chip (SoCs) widely used in popular True Wireless Stereo (TWS) earbuds and headphones from brands like Sony (e.g., WH-1000XM5, WF-1000XM5), JBL (e.g., Live Buds 3), Marshall (e.g., Major V), and Beyerdynamic (e.g., Amiron 300). These flaws stem from an unauthenticated, exposed proprietary diagnostic protocol called RACE, accessible over Bluetooth Classic and BLE, which allows attackers within range to connect to headphones, read/write memory, eavesdrop via the microphone, and spy on media. By chaining these vulnerabilities, attackers can perform "Headphone Jacking," stealing the Bluetooth Link Key from the headphone's flash memory to impersonate the trusted device and hijack the connected smartphone, enabling actions such as triggering voice assistants, sending text messages, or silently accepting calls and receiving audio streams. While some manufacturers are releasing patches, the fragmented Bluetooth market leaves many devices vulnerable, prompting recommendations for immediate firmware updates or, for high-risk individuals, the use of wired headphones.

Severity: Critical

Sources

Threat Details and IOCs

CVEs:CVE-2025-20700, CVE-2025-20701, CVE-2025-20702
Technologies:Airoha Bluetooth SoC, Apple iOS, beyerdynamic, Bose, Google Android, Jabra, JBL, Marshall
Victim Industries:Consumer Electronics, Semiconductors
Victim Countries:Denmark, Germany, Japan, Sweden, Taiwan, United States

Mitigation Advice

  • Compile an inventory of all Bluetooth headphones used by employees, cross-referencing the list with the models mentioned in the article (e.g., Sony WH-1000XM5, JBL Live Buds 3) to identify potentially vulnerable Airoha-based devices.
  • Instruct users with identified vulnerable headphone models to immediately check for and apply the latest firmware updates provided by the manufacturer via their respective mobile applications.
  • Issue a security advisory to all employees, with specific guidance for high-risk individuals such as executives and finance personnel, recommending they use wired headphones until their Bluetooth devices are confirmed to be patched.
  • Use the 'RACE Toolkit' released by ERNW to actively scan and verify the vulnerability status of corporate-issued or high-risk employee headphones.

Compliance Best Practices

  • Develop and implement a corporate policy governing the use of personal and corporate-issued peripheral devices, including Bluetooth headphones, specifying approved models and minimum security requirements.
  • Establish a formal process for tracking and managing firmware updates for all approved IoT and peripheral devices, including headphones, to ensure they are patched in a timely manner.
  • Update the security awareness training program to include modules on the risks associated with Bluetooth peripherals, teaching users how to update device firmware and recognize signs of compromise.
  • Investigate and deploy Mobile Device Management (MDM) policies to restrict or control Bluetooth pairing on corporate smartphones, allowing connections only to approved and managed peripherals.

LangChain Serialization Flaw (CVE-2025-68664) Enables Secret Extraction, Code Execution

A critical serialization vulnerability, identified as CVE-2025-68664 (CVSS 9.3) for Python and CVE-2025-68665 (CVSS 8.6) for JavaScript, has been discovered in the LangChain ecosystem, affecting `langchain-core` and LangChain.js packages. Reported by Yarden Porat on December 4, 2025, and internally dubbed "LangGrinch," the flaw stems from improper handling of the internal `lc` key during serialization and deserialization by the `dumps()` and `dumpd()` functions. This allows user-controlled data containing the `lc` key to be misinterpreted as legitimate internal LangChain objects, leading to various impacts including secret extraction from environment variables (when `secrets_from_env` is enabled), arbitrary object creation, instantiation of classes from trusted namespaces, and potential arbitrary code execution via Jinja2 templates. A significant attack vector involves prompt injection through LLM response fields such as `metadata`, ``additional_kwargs`,` or ``response_metadata`.` Patches have been released, with `langchain-core` fixed in versions 1.2.5 and 0.3.81, `@langchain/core` in 1.1.8 and 0.3.80, and `langchain` in 1.2.3 and 0.3.37. These updates introduce an `allowed_objects` parameter for explicit class control during deserialization, disable Jinja2 templates by default, and turn off automatic loading of secrets from the environment. Users are strongly advised to update immediately to mitigate these risks, which underscore how classic deserialization vulnerabilities persist in AI-driven systems where model output must still be treated as untrusted input.

Severity: Critical

Sources

Threat Details and IOCs

CVEs:CVE-2023-36188, CVE-2024-27302, CVE-2025-68613, CVE-2025-68664, CVE-2025-68665
Technologies:Jinja2, LangChain Core, LangChainGo, Microsoft TypeScript, n8n, Node.js, Python
Victim Industries:E-commerce, Financial Services, Food Delivery, Government, Healthcare, IT Services, Legal Services, Logistics, Manufacturing, Professional Services, Recruitment, Retail, Software, Software as a Service (SaaS), Sports and Entertainment, Technology Hardware, Telecommunications

Mitigation Advice

  • Update all Python applications using the `langchain-core` package to version 1.2.5 or newer, or to version 0.3.81 or newer, to mitigate CVE-2025-68664.
  • Update all JavaScript/TypeScript applications using the `@langchain/core` package to version 1.1.8 or newer (or 0.3.80 or newer) and the `langchain` package to version 1.2.3 or newer (or 0.3.37 or newer) to mitigate CVE-2025-68665.
  • Perform an immediate scan of all code repositories and deployed applications to identify all instances of the vulnerable `langchain-core`, `@langchain/core`, and `langchain` packages and their versions.
  • In all applications using LangChain, immediately review configurations and explicitly set the `secrets_from_env` (Python) and `secretsFromEnv` (JavaScript) parameters to `false` to prevent unauthorized access to environment variables.

Compliance Best Practices

  • Implement a secure development policy that mandates treating all output from Large Language Models (LLMs) as untrusted external input, requiring strict validation and sanitization before it is processed by sensitive functions like deserializers.
  • Refactor all applications that use LangChain's deserialization functions (`load()`, `loads()`) to use the `allowed_objects` parameter, creating a strict allowlist of only the specific classes required for the application to function.
  • Review and re-architect applications using AI/ML frameworks to operate under the Principle of Least Privilege, ensuring their execution environments are isolated and have access to the minimum set of secrets and permissions necessary for their function.
  • Establish a secure baseline configuration standard for all AI/ML frameworks that disables high-risk features, such as remote code execution via templating engines, by default. Require a formal security review and exception process to enable them.

Trust Wallet Confirms Extension Hack Led to $7 Million Crypto Theft

On December 24, a compromised update to the Trust Wallet Chrome extension, specifically version 2.68.0, resulted in the theft of $7 million in cryptocurrency, with users reporting their wallets drained shortly after interacting with the extension. Security researchers identified malicious code within the 2.68.0 update, which exfiltrated sensitive wallet data, including seed phrases, to an external server hosted at `api.metrics-trustwallet[.]com`, a domain registered just days prior to the incident. Trust Wallet confirmed the security breach, advising affected users to immediately disable version 2.68.0 and update to the secure version 2.69; mobile-only users and other browser extension versions were not impacted. Binance founder Changpeng "CZ" Zhao stated that Trust Wallet would cover the losses. Simultaneously, a phishing campaign emerged, utilizing domains such as `fix-trustwallet[.]com` to impersonate Trust Wallet and solicit users' recovery seed phrases under the pretense of a "vulnerability fix." Users whose wallets may have been compromised are urged to transfer any remaining funds to a new wallet secured with a fresh seed phrase.

Severity: Critical

Sources

Threat Details and IOCs

Malware:Mac.c, MacSync, MacSync Stealer
CVEs:CVE-2023-31290
Technologies:Brave Browser, Google Chrome, Google Chrome Web Store, Microsoft Edge, Opera, Trust Wallet
Attacker Countries:North Korea, United Kingdom
Attacker Domains:api.metrics-trustwallet.com, fix-trustwallet.com, metrics-trustwallet.com
Attacker URLs:https://api.metrics-trustwallet.com, hxxp://api.metrics-trustwallet.com
Victim Industries:Blockchain, Financials, Financial Services, Financial Technology, Information Technology, Software, Technology Hardware
Victim Countries:Hong Kong, Russia, Singapore, United States, Vietnam

Mitigation Advice

  • Add the domains `api.metrics-trustwallet[.]com` and `fix-trustwallet[.]com` to the network firewall's blocklist.
  • Configure the corporate DNS filtering service to block resolution of the domains `api.metrics-trustwallet[.]com` and `fix-trustwallet[.]com`.
  • Use the endpoint management tool to scan all corporate devices for the presence of the Trust Wallet Chrome extension, specifically version 2.68.0, and report any findings to the security team for remediation.
  • Send a company-wide security bulletin warning employees about the Trust Wallet supply chain attack and its associated phishing campaign. Instruct users to never enter credentials or recovery phrases in response to unsolicited prompts and to report suspicious browser behavior.

Compliance Best Practices

  • Develop and implement a corporate policy to only allow approved browser extensions on company devices, enforcing this policy via browser management tools like Group Policy or an MDM solution.
  • Establish a formal supply chain risk management process to vet the security posture of all third-party software vendors and applications, including browser extensions, before they are approved for use in our environment.
  • Incorporate modules on the risks of browser extensions and supply chain attacks into the recurring security awareness training program, reinforcing lessons with periodic phishing simulations.
  • Design and implement a network egress filtering policy on the perimeter firewall to deny outbound traffic by default, only allowing connections to known-good, categorized, and business-required destinations.

React2Shell Explained (CVE-2025-55182): From Vulnerability Discovery to Exploitation

A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code on vulnerable servers via a single crafted HTTP request. This flaw exploits weaknesses in the React Flight protocol's deserialization process, specifically by manipulating prototype chains and injecting malicious code during server-side rendering. The exploit chain leverages JavaScript's prototype traversal `(`__proto__:constructor`),` the thenable behavior, the `@` syntax for raw chunk objects, forced execution of `initializeModelChunk()`, context confusion through the `_response` object, and blob resolution to trigger the `Function()` constructor with attacker-controlled code. Affected software includes React versions 19.0.0 through 19.2.0, Next.js applications utilizing the App Router (versions 16.0.0-16.0.6, 15.x, and early 16.x releases), and associated serialization libraries like `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` prior to vendor patches. Due to the widespread adoption of React and Next.js, this vulnerability presents a significant risk, bypassing traditional security defenses. Immediate mitigation requires upgrading to React 19.2.1+ and Next.js 16.0.7+, regenerating all secrets and credentials, implementing WAF/API Gateway rules to detect suspicious React Flight chunk structures or references to `__proto__` or `prototype`, hardening RSC/Next.js deployments with minimal privileges and isolation, and actively hunting for indicators of compromise such as unexpected `.then()` behavior or shell command execution from Node.js processes.

Severity: Critical

Sources

Threat Details and IOCs

Malware:Agenda, AIRASHI, Aisuru, Akira, Akira_v2, Albiriox, AMOS, ANGRYREBEL, Angryrebel.Linux, ANGRYREBEL.LINUX, Atomic macOS Stealer, Atomic Stealer, Auto-color, Auto-Color, Backdoor.Linux.BPFDOOR, Backdoor.Linux.GHOSTPENGUIN.A, Backdoor.PHP.GODZILLA.B, Backdoor.Solaris.BPFDOOR.ZAJE, BADCALL, Bashlite, Beacon, BEACON, BeaverTail, BlackWidow, BPFDoor, Brickstorm, BrickStorm, BRICKSTORM, Broadside, CatDDoS, Chaos, CinaRAT, Cobalt Strike, Cobalt Strike Beacon, Compood, COMPOOD, CowTunnel, CplRAT, DarkWisp, DDoS.Linux.KAIJI.A, EncryptHub, EncryptHub Stealer, EtherRAT, FARGO, Fast Reverse Proxy, Fickle Stealer, FRP, Gafgyt, GhostPenguin, GhostWebShell, GobRAT, Godzilla, Godzilla Webshell, GO Simple Tunnel, GOST, H2Miner, Hisonic, HISONIC, IceNova, Jackpot, Java/Webshell.AX, JustForFun, Kaiji, Kaiji_Pro, Kinsing, KSwapDoor, Lamia Loader, LamiaLoader, Latrodectus, LizardStresser, Lizkebab, Lotus, Mallox, Mario, Mario ESXi, Masuta, MedusaLocker, Megazord, MetaRAT, Minocat, MINOCAT, Miori, Mirai, MuddyViper, NexusRoute, Nezha, Nezha agent, Nezha Agent, Noodle RAT, NoodleRAT, NoodlerRat, Nood RAT, NosyDoor, NosyStealer, NSPPS, NTPClient, Okiru, OMG, Omni, PCPcat, PeerBlight, PlugX, Predator, PULSEPACK, PwnRig, Qbot, Qilin, Quasar RAT, QuasarRAT, RansomHouse, Rhadamanthys, Rondo, RondoDox, RondoWorm, Satori, Sha1-Hulud, ShadowPad, Shai-Hulud, SilentPrism, Sliver, Snowlight, SnowLight, SNOWLIGHT, Supershell, TargetCompany, ToolShell, Torlus, Unidentified 111, Vshell, VShell, VSHELL, Weaxor, White Rabbit, Wicked, Win64.Coinminer.Xmrig, XMRig, xRAT, XShade, Yggdrasil, ZinFoq, ZnDoor
CVEs:CVE-2015-4852, CVE-2021-4034, CVE-2025-1338, CVE-2025-29927, CVE-2025-31324, CVE-2025-55182, CVE-2025-55183, CVE-2025-55184, CVE-2025-61757, CVE-2025-66478, CVE-2025-67779
Technologies:Akamai App & API Protector, Alibaba Cloud, Amazon AWS WAF, Amazon Elastic Compute Cloud (EC2), Amazon Lambda, Amazon Web Services, Amazon Web Services Fargate, AppArmor, busboy, Cloudflare, Dify, DigitalOcean App Platform, Docker, Electron, Expo, Express.js, F5 NGINX, Flask, Git, GitHub, Google Android, Google App Engine, Google Chrome, Google Cloud Armor, Google Cloud Platform, Google Cloud Run, Google Firebase, Google Kubernetes Engine, Koa, Kubernetes, Linux, LobeChat, Meta React Server Components, Microsoft Azure, Microsoft Edge, Microsoft Windows, Node.js, NUUO Camera, Oracle Fusion Middleware, Parcel, Parcel RSC plugin, PHP, PM2, PostgreSQL, Python, PyYAML, React, React Router, RedwoodJS, SAP NetWeaver, SELinux, Shopify React Router, TRENDnet, Vercel, Vercel Next.js, Vercel Turbopack, Vite, Vite plugin-rsc, Waku, Webpack
Threat Actors:Angryrebel, APT22, APT29, APT32, APT41, Beavertail, BronzeSnowdrop, CL-STA-1015, CLSTA1015, CozyBear, DeceptiveDevelopment, DecisiveArchitect, DemonicAgents, DEV-0322, DicingTaurus, DragnetPanda, EarthBluecrow, EarthLamia, EarthLumia, ExoticLily, FamousChollima, GoldenFactory, GymkhanaStudio, HiddenOrbit, HoundstoothTyphoon, Jackpot Panda, JackpotPanda, Lamia, Lazarus, LazarusGroup, M00nlight, MUSTANGPANDA, NexusRoute, NickelTapestry, OceanLotus, PCP, PCPcat, PoisonCarp, RedMenschen, RedMenshen, RondoDoX, ShadyPanda, Shathak, Storm-1877, Suckfly, TA551, TunnelBuilders, Unc5174, UNC5267, UNC5342, UNC5454, UNC6586, UNC6588, UNC6595, UNC6600, UNC6603, VimImpersonators, WageMole
Attacker Countries:Armenia, Azerbaijan, Belarus, Brazil, Bulgaria, China, Egypt, France, Georgia, Germany, Hong Kong, India, Indonesia, Iran, Ireland, Japan, Kazakhstan, Kyrgyzstan, Laos, Netherlands, North Korea, Panama, Poland, Russia, Singapore, Taiwan, Tajikistan, United States, Uzbekistan
Attacker IPs:102.41.112.148, 103.135.101.15, 104.168.9.49, 104.238.61.32, 107.174.123.91, 115.42.60.223, 128.199.143.161, 140.99.223.178, 143.198.92.82, 146.88.129.138, 149.28.25.254, 154.26.190.6, 154.61.77.105, 154.61.80.242, 154.89.152.240, 156.193.212.244, 156.234.209.103, 16.16.83.161, 162.215.170.26, 169.254.169.254, 171.252.32.135, 172.237.55.180, 172.245.79.16, 173.249.8.102, 176.117.107.154, 177.84.130.195, 183.6.80.214, 185.126.82.162, 185.229.32.220, 185.247.224.41, 185.253.118.70, 192.238.202.17, 193.143.1.153, 193.24.123.68, 193.34.213.150, 194.38.11.3, 194.69.203.32, 196.251.100.191, 196.251.66.201, 200.4.115.1, 206.237.3.150, 207.148.79.178, 209.141.49.251, 212.237.120.249, 212.69.85.41, 216.158.232.43, 216.238.68.169, 217.60.248.193, 23.132.164.54, 23.19.231.97, 23.226.71.197, 23.226.71.200, 23.226.71.209, 23.228.188.126, 23.235.188.3, 2.56.176.35, 31.56.27.76, 31.56.27.97, 31.57.46.28, 37.27.217.205, 38.162.112.141, 38.165.44.205, 38.47.103.117, 38.85.206.203, 39.97.229.220, 40.113.172.145, 41.231.37.153, 43.156.70.172, 45.129.56.148, 45.13.227.97, 45.134.174.235, 45.153.34.41, 45.157.233.80, 45.194.22.139, 45.221.113.96, 45.221.114.250, 45.32.126.137, 45.32.158.54, 45.76.155.14, 45.77.33.136, 46.36.37.85, 47.84.57.207, 47.84.79.46, 47.84.82.8, 47.98.194.60, 48.216.241.15, 49.51.230.175, 5.161.227.224, 51.81.104.115, 51.91.77.94, 52.252.226.141, 54.178.19.122, 59.7.217.245, 65.49.233.42, 67.215.246.10, 67.217.57.240, 68.142.129.4, 68.178.168.171, 72.62.67.33, 78.153.140.16, 80.210.220.54, 80.64.16.241, 8.134.195.179, 82.163.22.139, 82.221.103.244, 8.222.213.56, 87.98.162.88, 89.144.31.18, 91.215.85.42, 92.246.87.48, 95.169.180.135
Attacker Emails:gymkhanastudiodev@gmail.com, gymkhana.studio@gmail.com, support@c3pool.com
Attacker Domains:2f7ac6.ceye.io, 5axzi7.dnslog.cn, anywherehost.site, api.hellknight.xyz, api.qtss.cc, auto.c3pool.org, aws.orgserv.dnsnet.cloud.anondns.net, ax29g9q123.anondns.net, bafybeic6wxbl5h5adfuuh5r7n5vdbjwiy4w7zw42yb3tclutq6lscyefcm.ipfs.dweb.link, c3pool.com, conclusion-ideas-cover-customise.trycloudflare.com, cxsecurity.com, dashboard.checkstauts.site, dht.transmissionbt.com, donaldjtrmp.anondns.net, eth.drpc.org, ethereum-rpc.publicnode.com, eth.llamarpc.com, eth-mainnet.public.blastapi.io, eth.merkle.io, evil.com, f003.backblazeb2.com, gfxnick.emerald.usbx.me, ghostbin.axel.org, gist.github.com, gist.githubusercontent.com, github.com, grabify.link, help.093214.xyz, hybird-accesskey-staging-saas.s3.dualstack.ap-northeast-1.amazonaws.com, inerna1.site, ip.inovanet.pt, keep.camdvr.org, kisandost.online, krebsec.anondns.net, labubu.anondns.net, mail.wrufff.de, mainnet.gateway.tenderly.co, meomeoli.mooo.com, metadata.google.internal, mparivahan1.github.io, newratte.linkpc.net, nodejs.org, overcome-pmc-conferencing-books.trycloudflare.com, packetstormsecurity.com, pool.hashvault.pro, pool.supportxmr.com, proxy1.ip2worlds.vip, raw.githubusercontent.com, react2shell.com, reactcdn.windowserrorapis.com, repositorylinux.xyz, res.qiqigece.top, router.bittorrent.com, router.utorrent.com, rpc.flashbots.net, rpc.mevblocker.io, rpc.payload.de, rtochallan0283837.store, rtochallan09363737.store, rtochallan0963736.store, rtochallan1023456789.store, rtochallan1234567890.space, rtochallan1239542138464.shop, rtochallan5464643779878.online, rtochallan54648481854648.shop, rtochallan55354587558888.store, rtochallan6272526.store, rtochallan6392860193.store, rtochallan7337376.online, rtochallan78658857846758855.space, rtochallan8081458623124.shop, rtochallan8373737.store, rtochallan8373763635.online, rtochallan83937383839282.shop, rtochallan908102.store, rtochallan9087654532.store, rtochallan92727263.store, rtochallan9651382255.shop, sapo.shk0x.net, sup001.oss-cn-hongkong.aliyuncs.com, superminecraft.net.br, t.cnzzs.co, tr.earn.top, usbx.me, vip.kof97.lol, vps-zap812595-1.zap-srv.com, webhook.site, www.asc3t1c-nu11secur1ty.com, www.exploit-db.com, www.patreon.com, xpertclient.net, xss.pro, xwpoogfunv.zaza.eu.org
Attacker URLs:140.99.223.178/32736, 45.134.174.235/2.sh, 45.134.174.235/?h=45.134.174.235&p=80&t=tcp&a=l64&stage=true, 45.134.174.235/solra, auto.c3pool.org:443, bafybeic6wxbl5h5adfuuh5r7n5vdbjwiy4w7zw42yb3tclutq6lscyefcm.ipfs.dweb.link, git@github.com:acheong08/CVE-2025-55182-poc.git, git@github.com:klassiker/CVE-2025-55182.git, git@github.com:msanft/CVE-2025-55182.git, grabify.link/SEFKGU, hsxp://115.42.60.223:61236/slt, http://104.238.61.32:8080/zold, http://154.61.77.105:8082/, http://154.89.152.240/check.sh, http://156.234.209.103:20912/get.sh, http://156.234.209.103:63938/nrCrQ, http://162.215.170.26:3000/sex.sh, http://169.254.169.254/latest/meta-data/iam/security-credentials/, http://172.237.55.180/c, http://173.249.8.102, http://176.117.107.154/bot, http://177.84.130.195/sex.sh, http://177.84.130.195/sex.sh.2, http://185.229.32.220:21642/2lt4de8wgl54wtjgo8/winds, http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh, http://193.34.213.150/nuts/bolts, http://193.34.213.150/nuts/x86, http://193.34.213.150/x86, http://200.4.115.1/promocionao.php, http://216.158.232.43:12000/sex.sh, http://23.132.164.54/bot, http://23.19.231.97:36169/222, http://23.19.231.97:44719/222, http://23.19.231.97:47023/222, http://23.228.188.126/rondo.aqu.sh, http://23.235.188.3:652/qMqSb, http://23.235.188.3:REDACTED, http://31.56.27.76/n2/x86, http://31.57.46.28/test.sh, http://40.113.172.145/EdgeConsulting/frontend/sex.sh, http://41.231.37.153/rondo.aqu.sh, http://45.32.158.54/5e51aff54626ef7f/x86_64, http://45.76.155.14/vim, http://46.36.37.85:12000/sex.sh, http://47.84.82.8/index, http://47.84.82.8/upload, http://48.216.241.15/newsite/sex.sh.2, http://51.81.104.115/nuts/poop, http://67.217.57.240:5656/domains, http://67.217.57.240:5656/health, http://67.217.57.240:5656/result, http://67.217.57.240:5656/stats, http://67.217.57.240:666/files/proxy.sh, http://67.217.57.240:666/files/react.py, http://78.153.140.16/re.sh, http://8.222.213.56/index, http://89.144.31.18/nuts/bolts, http://89.144.31.18/nuts/x86, http://91.215.85.42:3000, http://91.215.85.42:3000/crypto/keys, http://anywherehost.site/xb/runner.zip, http://anywherehost.site/xb/systemd-devd.$(uname-m), http://anywherehost.site/xms/k1.sh?grep, http://anywherehost.site/xms/kill2.sh, http://anywherehost.site/xms/su, http://anywherehost.site/xms/t1.ps1, http://api.qtss.cc:443/en/about?source=redhat&id=v1.0, http://api.qtss.cc:443/en/about?source=redhat&id=v1.1, http://api.qtss.cc:443/en/about?source=redhat&id=v1.21136868377216160297393798828125, http://ax29g9q123.anondns.net, http://gfxnick.emerald.usbx.me/bot, http://help.093214.xyz:9731/fn32.sh, http://inerna1.site/xb/runner.zip, http://inerna1.site/xb/systemd-devd.x86_64, http://inerna1.site/xms/k1.sh, http://inerna1.site/xms/t1.ps1, http://ip.inovanet.pt/systemprofile.zip, http://keep.camdvr.org:8000/BREAKABLE_PARABLE10, http://keep.camdvr.org:8000/BREAKABLE_PARABLE5, http://keep.camdvr.org:8000/d5.sh, http://metadata.google.internal/computeMetadata/v1/, https://api.qtss.cc:443/en/about?source=redhat&id=v1.2, https://c3pool.com, https://cxsecurity.com/, https://eth.drpc.org, https://ethereum-rpc.publicnode.com, https://eth.llamarpc.com, https://eth-mainnet.public.blastapi.io, https://eth.merkle.io, https://f003.backblazeb2.com/file/mova12/98201-1-8/bot, https://gist.github.com/HerringtonDarkholme/87f14efca45f7d38740be9f53849a89f, https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3, https://gist.githubusercontent.com/demonic-agents/39e943f4de855e2aef12f34324cbf150/raw/e767e1cef1c3538689ba4df9c6f7f29a6afba1a/setup_c3pool_miner.sh, https://github.com/assetnote/react2shell-scanner, https://github.com/ChaIIan-94, https://github.com/explore-delhi, https://github.com/hackersatyamrastogi/react2shell-ultimate/, https://github.com/l4rm4nd/CVE-2025-55182, https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc, https://github.com/Legus-Yeung/CVE-2025-55182-exploit/, https://github.com/levi-gundert/NextRce_RSC_Exploit, https://github.com/msanft/CVE-2025-55182, https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/2025/flask-3.0.0-RCE/PoC.py, https://github.com/pavan202006/NextGen-mParivahan, https://github.com/pyroxenites/Nextjs_RCE_Exploit_Tool/, https://github.com/xmrig/xmrig/releases/latest, https://github.com/yunaranyancat/CVE-2025-55182-NSE/blob/main/CVE-2025-55182.nse, https://github.com/zack0x01/CVE-2025-55182-advanced-scanner-, https://grabify.link/SEFKGU, https://grabify.link/SEFKGU?dry87932wydes/fdsgdsfdsjfkl, https://mainnet.gateway.tenderly.co, https://mparivahan1.github.io/chk1/, https://nodejs.org/dist/v20.10.0/node-v20.10.0-linux-x64.tar.gz, https://nodejs.org/dist/v20.10.0/node-v20.10.0-linux-x64.tar.xz, https://packetstormsecurity.com/, https://raw.githubusercontent.com/C3Pool/xmrig_setup/master/setup_c3pool_miner.bat, https://raw.githubusercontent.com/C3Pool/xmrig_setup/master/setup_c3pool_miner.sh, https://raw.githubusercontent.com/C3Pool/xmrig_setup/master/xmrig.tar.gz, https://raw.githubusercontent.com/laolierzi-commits/phpbd/refs/heads/main/rjs/filemanager-standalone.js, https://raw.githubusercontent.com/nezhahq/scripts/main/agent/install.sh, https://react2shell.com/, https://repositorylinux.xyz/cron.sh, https://repositorylinux.xyz/script_kill.ps1, https://rpc.flashbots.net/fast, https://rpc.mevblocker.io, https://rpc.payload.de, https://sup001.oss-cn-hongkong.aliyuncs.com/123/python1.sh, https://t.me/Persy_PCP, https://t.me/teampcp, https://tr.earn.top/Log.php?id=, http://superminecraft.net.br:3000/sex.sh, https://webhook.site/63575795-ee27-4b29-a15d-e977e7dc8361, https://www.asc3t1c-nu11secur1ty.com/, https://www.exploit-db.com/, https://www.patreon.com/posts/flask-3-1-2-rce-145264728, https://www.patreon.com/posts/ultimate-for-cve-146576050, hxxp://103.135.101.15/wocaosinm.sh, hxxp://104.238.61.32:8080/zold, hxxp://115.42.60.223:61236/slt, hxxp://146.88.129.138:5511/443nb64, hxxp://154.89.152.240/check.sh, hxxp://156.234.209.103:20912/get.sh, hxxp://156.234.209.103:20913/get.sh, hxxp://162.215.170.26:3000/sex.sh, hxxp://172.237.55.180/b, hxxp://172.237.55.180/c, hxxp://176.117.107.154/bot, hxxp://185.229.32.220:21642/2lt4de8wgl54wtjgo8/winds, hxxp://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh, hxxp://193.34.213.150/nuts/bolts, hxxp://193.34.213.150/nuts.sh, hxxp://193.34.213.150/nuts/x86, hxxp://194.38.11.3:1790/b.sh, hxxp://194.69.203.32:81/hiddenbink/colonna.arc, hxxp://194.69.203.32:81/hiddenbink/colonna.i686, hxxp://194.69.203.32:81/hiddenbink/react.sh, hxxp://196.251.100.191/no_killer/Exodus.arm4, hxxp://196.251.100.191/no_killer/Exodus.x86, hxxp://196.251.100.191/no_killer/Exodus.x86_64, hxxp://196.251.100.191/update.sh, hxxp://207.148.79.178:6608/sys.sh, hxxp://216.158.232.43:12000/sex.sh, hxxp://23.132.164.54/bot, hxxp://31.56.27.76/n2/x86, hxxp://31.56.27.97/scripts/4thepool_miner.sh, hxxp://38.165.44.205/1, hxxp://38.165.44.205/k, hxxp://38.165.44.205/s, hxxp://39.97.229.220:8006/httd, hxxp://41.231.37.153/rondo.aqu.sh, hxxp://41.231.37.153/rondo.arc700, hxxp://41.231.37.153/rondo.armeb, hxxp://41.231.37.153/rondo.armebhf, hxxp://41.231.37.153/rondo.armv4l, hxxp://41.231.37.153/rondo.armv5l, hxxp://41.231.37.153/rondo.armv6l, hxxp://41.231.37.153/rondo.armv7l, hxxp://41.231.37.153/rondo.i486, hxxp://41.231.37.153/rondo.i586, hxxp://41.231.37.153/rondo.i686, hxxp://41.231.37.153/rondo.m68k, hxxp://41.231.37.153/rondo.mips, hxxp://41.231.37.153/rondo.mipsel, hxxp://41.231.37.153/rondo.powerpc, hxxp://41.231.37.153/rondo.powerpc-440fp, hxxp://41.231.37.153/rondo.sh4, hxxp://41.231.37.153/rondo.sparc, hxxp://41.231.37.153/rondo.x86_64, hxxp://45.32.158.54/5e51aff54626ef7f/x86_64, hxxp://45.76.155.14/vim, hxxp://46.36.37.85:12000/sex.sh, hxxp://47.84.57.207/index, hxxp://47.84.82.8/index, hxxp://47.84.82.8/upload, hxxp://51.81.104.115/nuts/bolts, hxxp://51.81.104.115/nuts/x86, hxxp://51.91.77.94:13339/termite/51.91.77.94:13337, hxxp://59.7.217.245:7070/app2, hxxp://59.7.217.245:7070/c.sh, hxxp://68.142.129.4:8277/download/c.sh, hxxp://8.222.213.56/index, hxxp://89.144.31.18/nuts/bolts, hxxp://89.144.31.18/nuts/x86, hxxp://95.169.180.135:8443/pamssod, hxxp://anywherehost.site/xb/runner.zip, hxxp://anywherehost.site/xb/systemd-devd.$(uname-m), hxxp://anywherehost.site/xms/k1.sh, hxxp://anywherehost.site/xms/k1.sh?grep, hxxp://anywherehost.site/xms/kill2.sh, hxxp://anywherehost.site/xms/su, hxxp://anywherehost.site/xms/t1.ps1, hxxp://ax29g9q123.anondns.net, hxxp://donaldjtrmp.anondns.net:1488/labubu, hxxp://gfxnick.emerald.usbx.me/bot, hxxp://help.093214.xyz:9731/FF22, hxxp://help.093214.xyz:9731/fn32.sh, hxxp://inerna1.site/xb/runner.zip, hxxp://inerna1.site/xb/systemd-devd.x86_64, hxxp://inerna1.site/xms/k1.sh, hxxp://inerna1.site/xms/t1.ps1, hxxp://ip.inovanet.pt/systemprofile.zip, hxxp://keep.camdvr.org:8000/BREAKABLE_PARABLE10, hxxp://keep.camdvr.org:8000/BREAKABLE_PARABLE5, hxxp://keep.camdvr.org:8000/d5.sh, hxxp://krebsec.anondns.net:2316/dong, hxxp://labubu.anondns.net:1488/dong, hxxp://meomeoli.mooo.com:8820/CLoadPXP/lix.exe?pass=PXPa9682775lckbitXPRopGIXPIL, hxxp://res.qiqigece.top/nginx1, hxxps://216.238.68.169/ReactOS, hxxps://72.62.67.33/meshagents?id=w%40Exooh1EQmSgfpvXk%24Kctk3F4RFhqP5EYgH2mHXjcZDuo3H61xfEs%24OKLnWsj6D&installflags=0&meshinstall=6, hxxps://api.hellknight.xyz/js, hxxps://api.qtss.cc:443/en/about?source=redhat&id=v1.0, hxxps://api.qtss.cc:443/en/about?source=redhat&id=v1.1, hxxps://api.qtss.cc:443/en/about?source=redhat&id=v1.2, hxxps://conclusion-ideas-cover-customise.trycloudflare.com, hxxps://ghostbin.axel.org/paste/evwgo/raw, hxxps://gist.githubusercontent.com/demonic-agents/39e943f4de855e2aef12f34324cbf150/raw/e767e1cef1c35738689ba4df9c6f7f29a6afba1a/setup_c3pool_miner.sh, hxxps://hybird-accesskey-staging-saas.s3.dualstack.ap-northeast-1.amazonaws.com/agent, hxxps://overcome-pmc-conferencing-books.trycloudflare.com/p.png, hxxps://raw.githubusercontent.com/C3Pool/xmrig_setup/master/setup_c3pool_miner.sh, hxxps://sup001.oss-cn-hongkong.aliyuncs.com/123/python1.sh, hxxps://tr.earn.top/Log.php?id=SHA1, hxxp://superminecraft.net.br:3000/sex.sh, hxxp://vps-zap812595-1.zap-srv.com:3000/sex.sh, hxxp://xpertclient.net:3000/sex.sh, hybird-accesskey-staging-saas.s3.dualstack.ap-northeast-1.amazonaws.com/agent, reactcdn.windowserrorapis.com:443/?h=reactcdn.windowserrorapis.com&p=443&t=tcp&a=l64&stage=true, tcp://vip.kof97.lol:443
Attacker Hashes:011a62df99e52c8b73e259284ab1db47, 025f5e04e54497242749ec480310fd7e, 025f5e04e54497242749ec480310fd7e3ba4d5e0cf0557f03ee5a97a2de56511, 02d43e18172ed9a1be8edc44781228ba, 0450fe19cfb91660e9874c0ce7a121e0, 05f4407eb2e413c3babdc3054e6db032cadc51b2, 0972859984decfaf9487f9a2c2c7f5d2b03560a0, 0bc65a55a84d1b2e2a320d2b011186a14f9074d6d28ff9120cb24fcc03c3f696, 0f0f9c339fcc267ec3d560c7168c56f607232cbeb158cb02a0818720a54e72ce, 13675cca4674a8f9a8fabe4f9df4ae0ae9ef11986dd1dcc6a896912c7d527274, 1663d98c259001f1b03f82d0c5bee7cfd3c7623ccb83759c994f9ab845939665, 18c68a982f91f665effe769f663c51cb0567ea2bfc7fab6a1a40d4fe50fc382b, 1a3e7b4ee2b2858dbac2d73dd1c52b1ea1d69c6ebb24cc434d1e15e43325b74e, 1cdd9b0434eb5b06173c7516f99a832dc4614ac10dda171c8eed3272a5e63d20, 1ce4b6a89d2daa0cab820711d8424a7676ef5ff2, 1e31dc074a4ea7f400cb969ea80e8855b5e7486660aab415da17591bc284ac5b, 1e54a769e692a69d74f598e0b1fdb2949f242de3, 1f3f0695c7ec63723b2b8e9d50b1838df304821fcb22c7902db1f8248a812035, 20e1465fd07f0d4e19c299fb0d9af8e5ec1b21d2, 264e1a820b8b3bbd13325955f06aff2678c69935, 267b27460704e41e27d6f2591066388f, 2937c58115c131ae84a1b2a7226c666f6a27ef88, 2b0dc27f035ba1417990a21dafb361e083e4ed94a75a1c49dc45690ecf463de4, 2ca913556efd6c45109fd8358edb18d22a10fb6a36c1ab7b2df7594cd5b0adbc, 2cd41569e8698403340412936b653200005c59f2ff3d39d203f433adb2687e7f, 2ebed29e70f57da0c4f36a9401a7bbd36e6ddd257e0920aa4083240afa3a6457, 33641bfbbdd5a9cd2320c61f65fe446a2226d8a48e3bd3c29e8f916f0592575f, 34551bca762be99d732c0ced6ad8b0a2f7b11ad7, 3854862bb3ee623f95d91fa15b504e2bbc30e23f1a15ad7b18aedb127998c79c, 3a7b89429f768fdd799ca40052205dd4, 3ba4d5e0cf0557f03ee5a97a2de56511, 3ba7c58df9b6d21c04eaa822738291b60c65b7c8, 3efbaca4b784bc49455565d443232c72, 470ce679589e1c3518c3ed2b818516f27ccad089, 4745703f395282a0687def2c7dcf82ed1683f3128bef1686bd74c966273ce1c5, 4a74676bd00250d9b905b95c75c067369e3911cdf3141f947de517f58fc9f85c, 4a759cbc219bcb3a1f8380a959307b39873fb36a9afd0d57ba0736ad7a02763b, 4cbdd019cfa474f20f4274310a1477e03e34af7c62d15096fe0df0d3d5668a4d, 4ec926d579c8540e4eb8e4eff3d0fc9060410ce5218293ddebd9ddb36e76b7e6, 4ff096fbea443778fec6f960bf2b9c84da121e6d63e189aebaaa6397d9aac948, 533585eb6a8a4aad2ad09bbf272eb45b, 55ae00bc8482afd085fd128965b108cca4adb5a3a8a0ee2957d76f33edd5a864, 5a6fdcb5cf815ce065ee585a210c19d1c9efb45c293476554bf1516cc12a1bab, 5bde055523d3b5b10f002c5d881bed882e60fa47393dff41d155cab8b72fc5f4, 5d368356bd49c4b8e3c423c10ba777ff52a4f32a, 622f904bb82c8118da2966a957526a2b, 622f904bb82c8118da2966a957526a2ba51a5c1e7d2bc3f7b2e3489f92a55d46, 62e9a01307bcf85cdaeecafd6efb5be72a622c43a10f06d6d6d3b566b072228d, 65d840b059e01f273d0a169562b3b368051cfb003e301cc2e4f6a7d1907c224a, 661d3721adaa35a30728739defddbc72b841c3d06aca0abd4d5e0aad73947fb1, 6957c6d7f21f698d5ce6734dc00aeddc317d5875c3fd16b8b4a54259e02c46c5, 6e43e26fa62dfa89fe8b016dc831a9ec44507af9, 73000ab2f68ecf2764af133d1b7b9f0312d5885a75bf4b7e51cd7b906b36e2d4, 732226c0966fe29116b147e893c35ce7df1c8f1a, 776850a1e6d6915e9bf35aa83554616129acd94e3a3f6673bd6ddaec530f4273, 791f123b3aaff1b92873bd4b7a969387, 7c2d9c6ae9c811c62e67a6279fec0b68047a031eae674d3d5f9279a4ec7e8a25, 7c8010d9ab6dfdc7a99aba7075a793260acbf2b8, 7d25a97be42b357adcc6d7f56ab01111378a3190134aa788b1f04336eb924b53, 7e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f244bf271d2e5, 7f05bad031d22c2bb4352bf0b6b9ee2ca064a4c0e11a317e6fedc694de37737a, 7fe3826fc7b90e20c9fe76a7891eff350d73b6b3, 858874057e3df990ccd7958a38936545938630410bde0c0c4b116f92733b1ddb, 876923709213333099b8c728dde9f5d86acfd0f3702a963bae6a9dde35ba8e13, 88af4a140ec63a15edc17888a08a76b2, 895f8dff9cd26424b691a401c92fa7745e693275c38caf6a6aff277eadf2a70b, 8fee14142577734282aa1f53ea2e5cddaf4a588de40e7b179b13855330077b96, 91152e6ffe0474b06bb52f41ab3f3545ac360e64, 92064e210b23cf5b94585d3722bf53373d54fb4114dca25c34e010d0c010edf3, 9c931f7f7d511108263b0a75f7b9fcbbf9fd67ebcc7cd2e5dcd1266b75053624, 9e9514533a347d7c6bc830369c7528e07af5c93e0bf7c1cd86df717c849a1331, a26c70f34d35f78f0b95bf402d513f69e196720576d9115dba0efdb4c57deb81, a455731133c00fdd2a141bdfba4def34ae58195126f762cdf951056b0ef161d4, a51a5c1e7d2bc3f7b2e3489f92a55d46, a605a70d031577c83c093803d11ec7c1e29d2ad530f8e95d9a729c3818c7050d, aaca45131c5a5a95d384431e415474f7ca7f4b8e296fc4ef46ecb07218434e1b, aba3e587430fae0877a2e0fb07866427a092dc4eccb0db17715d62b7a7c0c992, ac2182dfbf56d58b4d63cde3ad6e7a52fed54e52959e4c82d6fc999f20f8d693, ac7027f30514d0c00d9e8b379b5ad8150c9827c827dc7ee54d906fc2585b6bf6, b38ec4c803a2d84277d9c598bfa5434fb8561ddad0ec38da6f9b8ece8104d787, b568582240509227ff7e79b6dc73c933dcc3fae674e9244441066928b1ea0560, b5acbcaccc0cfa54500f2bbb0745d4b5c50d903636f120fc870082335954bec8, b63860cefa128a4aa5d476f300ac45fd5d3c56b2746f7e72a0d27909046e5e0f, bc31561c44a36e1305692d0af673bc5406f4a5bb2c3f2ffdb613c09b4e80fa9f, be86823d73a01266b096dab1628cfa2e4ca77265, bf602b11d99e815e26c88a3a47eb63997d43db8b8c60db06d6fbddf386fd8c4a, bf9d7224e709b4ac90a498418af20d3a, c2867570f3bbb71102373a94c7153239599478af84b9c81f2a0368de36f14a7c, c38c21120d8c17688f9aeb2af5bdafb6b75e1d2673b025b720e50232f888808a, c3924fc5a90b6120c811eb716a25c168c72db0ba, c50db4734195579e83834b2a84758ceae13a61420568eb596224ff8e48ea415a, c6381ebf8f0349b8d47c5e623bbcef6b, c67e8aa881317cb32d7c36b2e3c0c5cfa21bf5e3, c6c7e7dd85c0578dd7cb24b012a665a9d5210cce8ff735635a45605c3af1f6ad, d033d0e44b4f4be7ca3b8d063ea95699d1c894896ef912bf52c2296bc73f8838, d17e958bf9b079c7ca98f54324e6c2f31e9c1d4c7945e8bc190895c08c762655, d3c897e571426804c65daae3ed939eab4126c3aa3fa8531de5e8f0b66629fe8a, d3e7b234cf76286c425d987818da3304, d60461b721c0ef7cfe5899f76672e4970d629bb51bb904a053987e0a0c48ee0f, d6e97c9783f0907f1ee9415736816e272a9df060, d704541cde64a3eef5c4f80d0d7f96dc96bae8083804c930111024b274557b16, d71779df5e4126c389e7702f975049bd17cb597ebcf03c6b110b59630d8f3b4d, d9313f949af339ed9fafb12374600e66b870961eeb9b2b0d4a3172fd1aa34ed0, da33bda52e9360606102693d68316f4ec1be673e, ddbbd528c3d0bcdd39617676c85dde33, df3f20a961d29eed46636783b71589c183675510737c984a11f78932b177b540, e2d7c8491436411474cef5d3b51116ddecfee68bab1e15081752a54772559879, e82057e481a2d07b177d9d94463a7441, ebdb85704b2e7ced3673b12c6f3687bc0177a7b1b3caef110213cc93a75da837, f1ee866f6f03ff815009ff8fd7b70b902bc59b037ac54b6cae9b8e07beb854f7, f347eb0a59df167acddb245f022a518a6d15e37614af0bbc2adf317e10c4068b, f6083acf5fde12d17fb5b3098242e92a48cbf122, f88ce150345787dd1bcfbc301350033404e32273c9a140f22da80810e3a3f6ea, fb3a6bdf98d5010350c04b2712c2c8357e079dec2d2a848d0dc2def2bafcc984, fc9e53675e315edeea2292069c3fbc91337c972c936ca0f535da01760814b125
Victim Industries:Aerospace, Artificial Intelligence, Automotive, Business Services, Cloud Infrastructure, Computer and Electronic Product Manufacturing, Construction, Consulting Services, Consumer Electronics, Consumer Packaged Goods, Critical Manufacturing, Cryptocurrency, Defense, E-commerce, Education, Energy, Financial, Financial and Insurance, Financials, Financial Services, Food & Beverage, Gambling & Gaming, Gaming, Government, Healthcare, Hospitality, Human Resources, Industrials, Information Technology, Internet & Cloud Services, Internet of Things (IoT), Internet Service Providers, IT Services, Legal and Professional Services, Legal Services, Logistics, Managed Security Service Provider (MSSP), Management Consulting, Manufacturing, Marketing & Advertising, Media and Entertainment, Multimedia, Online Gambling, Professional Services, Public Administration, Public Sector, Publishing, Real Estate, Retail, Social Media, Software, Sports and Entertainment, Supply Chain, Technology Hardware, Telecommunications, Transportation, Transportation & Logistics, Travel, Universities, Web Hosting
Victim Countries:Afghanistan, Antigua and Barbuda, Argentina, Australia, Austria, Bahamas, Bahrain, Barbados, Belgium, Belize, Bolivia, Brazil, Brunei, Bulgaria, Cambodia, Canada, Chile, China, Colombia, Costa Rica, Croatia, Cuba, Cyprus, Czech Republic, Denmark, Dominica, Dominican Republic, Ecuador, Egypt, El Salvador, Estonia, Finland, France, Germany, Greece, Grenada, Guatemala, Guyana, Haiti, Honduras, Hong Kong, Hungary, India, Indonesia, Iran, Iraq, Ireland, Israel, Italy, Jamaica, Japan, Jordan, Kazakhstan, Kuwait, Kyrgyzstan, Laos, Latvia, Lebanon, Lithuania, Luxembourg, Malaysia, Malta, Mexico, Mongolia, Myanmar, Nepal, Netherlands, New Zealand, Nicaragua, Nigeria, North Korea, Oman, Pakistan, Palestine, Panama, Paraguay, Peru, Philippines, Poland, Portugal, Qatar, Romania, Russia, Rwanda, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and the Grenadines, Saudi Arabia, Singapore, Slovakia, Slovenia, South Africa, South Korea, Spain, Suriname, Sweden, Switzerland, Syria, Taiwan, Thailand, Timor-Leste, Trinidad and Tobago, Turkey, United Arab Emirates, United Kingdom, United States, Uruguay, Venezuela, Vietnam, Yemen

Mitigation Advice

  • Upgrade all applications using React Server Components to React version 19.2.1 or later.
  • Upgrade all Next.js applications that use the App Router to version 16.0.7 or later.
  • Immediately rotate all API keys used by applications running vulnerable versions of React or Next.js.
  • Immediately rotate all database credentials used by applications running vulnerable versions of React or Next.js.
  • Immediately rotate all cloud infrastructure access tokens (e.g., AWS IAM roles, GCP service accounts, Azure Managed Identities) associated with environments running vulnerable applications.
  • Implement WAF rules to block or alert on HTTP POST requests to React Server Component endpoints that contain `__proto__` or `prototype` keywords in the request body.
  • Actively hunt for indicators of compromise by searching application and server logs for suspicious POST requests to RSC endpoints or evidence of shell command execution originating from Node.js processes.

Compliance Best Practices

  • Review and reconfigure service accounts for applications using React Server Components to ensure they operate under the principle of least privilege, with minimal necessary OS and cloud permissions.
  • Implement network segmentation policies to strictly control traffic between application servers, databases, and internal services, preventing lateral movement from a compromised web server.
  • Modify the deployment process for web applications to use read-only file systems or immutable container images, preventing attackers from persisting malware on the server.
  • Establish a secure coding program to audit all application components that perform data deserialization, ensuring they strictly validate and sanitize all client-provided input before processing.
  • Integrate an automated dependency scanning tool, such as Snyk or Dependabot, into the CI/CD pipeline to continuously monitor for and alert on newly discovered vulnerabilities in third-party libraries.

Stay updated on emerging threats: sign up for the F5 Threat Report to receive the Weekly Threat Report in your inbox.

Updated Dec 30, 2025
Version 2.0
security
threat report
No CommentsBe the first to comment