Fast Facts

• React2Shell (CVE-2025-55182) is a critical web vulnerability with a severity score of 10.0.
• 87,000 Italian servers - and nearly 9 million worldwide - are at immediate risk.
• No user action or login is needed for hackers to exploit this flaw.
• Chinese hacker groups are actively testing and exploiting the vulnerability right now.
• A patch exists, but widespread delays in applying it mean most servers remain vulnerable.

The Calm Before the Digital Storm

Imagine a city where every home is built with the same lock - and a skeleton key has just been posted online. That’s the stark reality facing thousands of Italian companies running servers with the React2Shell vulnerability. In December 2025, cybersecurity circles erupted as this new flaw, officially catalogued as CVE-2025-55182, was revealed. Its impact? Compared to the infamous Log4Shell crisis of 2021, but with a wider reach and even simpler exploitation.

From Log4Shell to React2Shell: A Brief History of Digital Panic

Log4Shell, discovered in late 2021, shook the tech world by letting attackers hijack servers running Java’s Log4j. That scandal led to global panic, urgent patching, and countless breaches. Fast forward: React2Shell targets a different ecosystem - web servers built with React 19 and Next.js, popular frameworks powering much of today’s internet. The difference? With React2Shell, attackers don’t even need a password, or for a victim to click a malicious link. The default setup is enough for a break-in.

The flaw lies in something called RSC serialization - a technical way servers process certain web requests. A hacker can send a special payload (think of it as a “magic knock”) to an exposed server. If successful, the server quietly hands over the keys, letting the attacker run any command they wish. Security researchers have already demonstrated this by remotely launching the Windows Calculator on target machines - a classic proof of total control.

Attackers Move Fast, Defenders Struggle to Catch Up

Chinese hacking groups have wasted no time. Using automated tools and public “proof-of-concept” code circulating on GitHub, they are scanning the internet for vulnerable servers - Italy’s 87,000 included. Tools like FOFA, a search engine for internet-connected devices, make it easy to pinpoint targets. Once found, attackers can quietly inject their payloads, confirm success using external logging tricks, and then escalate their attacks.

Unlike some past vulnerabilities, React2Shell is especially dangerous because even servers set up “by the book” are exposed. Many businesses may not realize that their web applications, by default, enable the risky feature. And while the React team has rushed out a patch, updating is not automatic. Companies must manually rebuild and redeploy their applications - a process that can take days or weeks. In the meantime, the digital doors remain wide open.

Geopolitics and the Supply Chain Domino

Italy isn’t alone: nearly 9 million servers globally are in the crosshairs. With web supply chains so interconnected, a breach in one company can ripple through partners, vendors, and clients. The situation is a goldmine for cybercriminals and a potential nightmare for national infrastructure. Security experts urge immediate patching, log analysis, and reinforced security policies - but warn that most organizations are still dangerously exposed.

WIKICROOK

• CVE: CVE, or Common Vulnerabilities and Exposures, is a system for uniquely identifying and tracking publicly known cybersecurity flaws in software and hardware.
• Remote Code Execution (RCE): Remote Code Execution (RCE) is when an attacker runs their own code on a victim’s system, often leading to full control or compromise of that system.
• Serialization: Serialization converts complex data into a format suitable for storage or network transfer, allowing easy saving, sharing, and reconstruction of information.
• Patch: A patch is a software update released to fix security vulnerabilities or bugs in programs, helping protect devices from cyber threats and improve stability.
• Proof: A Proof-of-Concept (PoC) is a demonstration showing that a cybersecurity vulnerability can be exploited, helping to validate and assess real risks.