React2Shell exploits continue with large-scale Linux backdoor deployments and cloud credential theft

አማርኛ

Ongoing exploitation of the React2Shell vulnerability (CVE-2025-55182)—previously detailed in coverage of China-nexus and cybercriminal campaigns—now includes widespread Linux backdoor installations, arbitrary command execution, and large-scale theft of cloud credentials.

Following earlier reports on PeerBlight and subsequent attacks by groups like UNC6600, UNC6586, UNC6588, UNC6603, and financially motivated actors deploying malware such as MINOCAT, SNOWLIGHT, HISONIC, COMPOOD, ANGRYREBEL.LINUX, and XMRig miners, cybersecurity researchers confirm active, large-scale exploitation of React2Shell (CVE-2025-55182).

Attackers continue leveraging this critical RCE flaw (CVSS 10.0, affecting React 19.0–19.2.0) to install backdoors on Linux systems, execute arbitrary commands, and target cloud credentials for theft.

While patches are available (React 19.0.1, 19.1.2, 19.2.1+), the persistent threats underscore the need for administrators to apply mitigations like Cloud Armor WAF, monitor IOCs from prior coverage, and secure React/Next.js applications amid software supply chain risks.

ተያያዥ ጽሁፎች

Illustration depicting the Linux CopyFail vulnerability enabling root access exploits alongside Ubuntu's DDoS-induced outage.
በ AI የተሰራ ምስል

Linux CopyFail exploit threatens root access amid Ubuntu outage

በAI የተዘገበ በ AI የተሰራ ምስል

A critical Linux vulnerability known as CopyFail, tracked as CVE-2026-31431, allows attackers to gain root access on systems running kernels since 2017. Publicly released exploit code has heightened risks for data centers and personal devices. Ubuntu's infrastructure has been offline for over a day due to a DDoS attack, hampering security communications.

Researchers discover SSHStalker botnet infecting Linux servers

Flare researchers have identified a new Linux botnet called SSHStalker that has compromised around 7,000 systems using outdated exploits and SSH scanning. The botnet employs IRC for command-and-control while maintaining dormant persistence without immediate malicious activities like DDoS or cryptomining. It targets legacy Linux kernels, highlighting risks in neglected infrastructure.

US government issues urgent CopyFail warning as Linux patches roll out

በAI የተዘገበ

Four days after the CopyFail (CVE-2026-31431) exploit disclosure disrupted Ubuntu services, the US government warned of its critical risks to Linux systems, urging immediate patching amid public exploit code.

Linux

New dirty frag exploit grants root access on linux systems

Linux

SSHStalker botnet uses IRC to target Linux servers

ቴክኖሎጂ

Veeam patches three critical security flaws in backup servers

Researchers uncover new SysUpdate malware variant targeting Linux

Researchers at LevelBlue have identified a new variant of the SysUpdate malware aimed at Linux systems during a digital forensics and incident response engagement. The malware disguises itself as a legitimate system service and employs advanced encryption for command-and-control communications. By reverse-engineering it, the team created tools to decrypt its traffic more quickly.

OpenClaw patches severe vulnerability granting admin access

በAI የተዘገበ

Developers of the popular AI tool OpenClaw released patches for three high-severity vulnerabilities, including one that allowed attackers with basic pairing privileges to silently gain full administrative control. The flaw, tracked as CVE-2026-33579 and rated up to 9.8 out of 10 in severity, has raised alarms among security experts. Thousands of exposed instances may have been compromised unknowingly.

May 04, 2026 03:03

Red Hat directs users to security page for CopyFail vulnerability

April 22, 2026 09:46

Microsoft patches critical ASP.NET Core vulnerability on macOS and Linux

February 23, 2026 08:01

Malicious npm packages harvest crypto keys and secrets

February 18, 2026 23:37

New SysUpdate malware variant targets Linux systems

February 18, 2026 11:16

Dell zero-day flaw unpatched for nearly two years

February 10, 2026 19:39

New Linux botnet SSHStalker uses IRC for command-and-control

February 10, 2026 10:59

BeyondTrust RCE flaw enables code execution without login

ይህ ድረ-ገጽ ኩኪዎችን ይጠቀማል

የእኛን ጣቢያ ለማሻሻል ለትንታኔ ኩኪዎችን እንጠቀማለን። የእኛን የሚስጥር ፖሊሲ አንብቡ የሚስጥር ፖሊሲ ለተጨማሪ መረጃ።
ውድቅ አድርግ