Cloudforce One sees active exploitation of React2Shell, with actors targeting critical infrastructure—including nuclear fuel and uranium operations. Probing is concentrated in Taiwan, Xinjiang, Vietnam, Japan, and New Zealand.
React also disclosed two new vulnerabilities (CVE-2025-55183 and CVE-2025-55184). Cloudflare customers are protected against all three flaws.
Read the full threat brief: https://blog.cloudflare.com/react2shell-rsc-vulnerabilities-exploitation-threat-brief/
