Hacker interest is high in a days-old vulnerability in widely used web application framework React, with dozens of ...

Critical vulnerability in React library should be treated by IT as they did Log4j - as an emergency, warns one expert.

A maximum severity vulnerability, dubbed 'React2Shell', in the React Server Components (RSC) 'Flight' protocol allows remote code execution without authentication in React and Next.js applications.

The attackers have learned from their mistakes and have now developed a more aggressive version of the worm. It has already stolen over 27,000 credentials.

While the September 2025 Shai-Hulud attack focused primarily on credential harvesting and self-propagation, this new variant introduces several critical capabilities that represent a fundamental shift ...