⚡ Weekly Recap: USB Malware, React2Shell, WhatsApp Worms, AI IDE Bugs & More

The weekly recap highlights a mix of rapid-fire cyber stories, including a critical React flaw tracked as CVE-2025-55182, also referred to as React2Shell, which researchers say has seen extensive exploitation within hours of disclosure. According to various security firms and researchers, the flaw enables remote code execution without authentication and has been linked to attack activity from Chinese-linked infrastructure, including groups such as Earth Lamia and Jackpot Panda.

The Shadowserver Foundation reported that 28,964 IP addresses were vulnerable to the React2Shell flaw as of 7 December 2025, down from 77,664 on 5 December, with about 10,100 in the U.S., 3,200 in Germany, and 1,690 in China. The round‑up also notes compromised USB campaigns; one described by AhnLab uses a batch dropper to deploy a PrintMiner and a Monero miner (XMRig) behind a hidden folder, with the shortcut file visible as the only user-facing item.

Elsewhere, DoJ actions included seizures of a fake cryptocurrency investment site Tickmilleas[.]com and related takedowns affecting associated accounts, as part of broader enforcement. The piece closes by underscoring the accelerating pace of vulnerabilities, exploits, and threat actors, urging patches, vigilance, and continued public‑facing alerts.