React2Shell: How Attackers Exploited CVE-2025-55182 Within Hours

React2Shell, also known as CVE-2025-55182, was exploited by opportunistic attackers within hours of its public disclosure, with Darktrace noting exploitation from honeypots deployed in the cloud just minutes after setup. According to Darktrace, the vulnerability allows remote code execution via an unauthenticated request in React Server Components’ Flight protocol, and a patch was released on 3 December 2025, after which a proof‑of‑concept emerged within 30 hours.

The campaign—nicknamed “Nuts & Bolts”—used a spreader server in Poland (IP 95.214.52[.]170) to probe port 3000 on NEXT.js servers, testing for vulnerability by running a whoami command and returning the result in an error digest. The attackers then deployed multiple payloads, including a Mirai‑variant x86 binary and a cryptominer, with C2 infrastructure hosted at 89.144.31[.]18 operated by a German provider, myPrepaidServer.

Darktrace observed the rapid sequence of beaconing, script downloads, and data exfiltration indicators across several environments, underscoring how quickly attackers can capitalise on unpatched flaws.