React2Shell exploitation: what the sustained attack wave means

TL;DR: React2Shell exploitation has continued at sustained, elevated volume, with more than 8.1 million attack sessions, over 8,163 source IPs across 1,071 ASNs and 101 countries, and 70,000 unique payloads seen since disclosure, according to GreyNoise. The pattern shows broad, automated exploitation that turns vulnerable React and Next.js deployments into a live access-risk problem, not a theoretical patching issue.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far”.

By the numbers:

• GreyNoise observed 8,163 unique source IPs across 1,071 ASNs spanning 101 countries.

Key questions

Q: What breaks when a framework flaw allows unauthenticated server-side execution?

A: The main failure is that the application tier stops being a control boundary.

Q: Why do cloud-hosted exploitation waves make static IP blocklists less effective?

A: Because attackers can rotate source IPs, ASNs, user agents and payload shapes much faster than defenders can maintain manual blocks.

Q: What signs suggest a web RCE campaign has moved into post-exploitation staging?

A: Look for encoded PowerShell, in-memory downloaders, suspicious script execution, AMSI tampering and repeated proof-of-execution commands that return deterministic output.

Practitioner guidance

• Patch exposed React and Next.js deployments first Prioritise internet-facing instances that can reach production data, cloud APIs or internal admin paths, then verify the fixed version is actually deployed across all environments.
• Replace static perimeter blocks with dynamic campaign blocking Use continuously updated threat feeds and fingerprint-based filtering so rotating IPs, ASNs and cloud hosts do not bypass a fixed denylist.
• Hunt for post-exploitation PowerShell activity Look for powershell.exe or pwsh.exe with encoded commands, DownloadString, IEX, AMSI tampering and suspicious script block patterns on affected Windows systems.

Bottom line: React2Shell is being exploited as an active campaign, so exposed framework instances should be treated as live access-risk endpoints rather than routine patch items.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →