Notifications
Clear all
Topic starter
02/08/2026 12:13 pm
TL;DR: React2Shell, a critical RCE flaw in React and Next.js, has exposed more than 77,000 internet-facing IPs and been used by state-backed actors and crypto miners against at least 30 organisations, according to Salt. The bigger lesson is that frontend compromise can become identity theft for internal APIs, cloud metadata, and downstream services.
NHIMG editorial — based on content published by Salt covering React2Shell: LLMjacking and infrastructure identity theft in web applications
By the numbers:
- Confirmed state-sponsored actors and opportunistic crypto miners have already breached at least 30 organizations.
Questions worth separating out
Q: What breaks when a frontend server is compromised and treated as trusted internally?
A: The trust boundary breaks because the server can inherit privileges, reach internal APIs, and request cloud credentials that perimeter tools do not inspect well.
Q: Why do compromised application servers increase lateral movement risk so quickly?
A: They already sit inside the environment, often with access to internal services, metadata endpoints, and backend systems.
Q: What do security teams get wrong about API perimeter controls?
A: They assume syntax inspection and request reputation are enough.
Practitioner guidance
- Map application servers as identity-bearing assets Create an inventory of frontend and backend workloads that can reach internal APIs, metadata services, or admin interfaces, then assign explicit owners and scope to each trust relationship.
- Restrict metadata-service reachability by default Block unnecessary access to cloud metadata services from application tiers and require explicit exceptions with logging.
- Discover and classify shadow APIs Scan for internal APIs, microservice endpoints, and admin interfaces that are reachable from frontend hosts but not from the internet, then classify them by sensitivity and exposure.
What's in the full article
Salt's full article covers the operational detail this post intentionally leaves for the source:
- A breakdown of the seven specific API compromise paths that follow a React2Shell foothold.
- Discussion of how attackers use cloud metadata services and internal APIs after initial server compromise.
- Practical guidance on internal API discovery and east-west monitoring from the vendor's API security perspective.
- Examples of the traffic patterns Salt says can reveal trusted-server abuse after the initial exploit.
👉 Read Salt's analysis of React2Shell and infrastructure identity theft →
React2Shell and infrastructure identity theft: are API controls enough?
Explore further
02/08/2026 1:16 pm
Infrastructure identity theft is the right lens for React2Shell. This is not just an RCE story, because the real risk begins when a compromised frontend inherits trust that was never meant to be transferable. The server's identity becomes the attacker’s identity in practice, which is exactly why API security and identity governance converge here. Practitioners should treat application servers as high-value non-human identities, not just compute instances.
A few things that frame the scale:
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%), according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: How should organisations respond when cloud metadata access is reachable from app servers?
A: They should treat that as a privileged pathway, not a convenience. Access should be removed where possible, tightly scoped where necessary, and monitored for unusual token requests or downstream use. If metadata access cannot be eliminated, the workload should be assumed high risk and watched like a privileged identity.
👉 Read our full editorial: React2Shell exposes infrastructure identity theft in web apps
