Les exploitations de React2Shell se poursuivent avec des déploiements à grande échelle de backdoors Linux et vol de credentials cloud

16 décembre 2025

Rapporté par l'IA

L'exploitation en cours de la vulnérabilité React2Shell (CVE-2025-55182)—détaillée précédemment dans la couverture des campagnes China-nexus et cybercriminelles—inclut maintenant des installations étendues de backdoors Linux, l'exécution de commandes arbitraires et le vol à grande échelle de credentials cloud.

À la suite de rapports antérieurs sur PeerBlight et d'attaques ultérieures par des groupes tels que UNC6600, UNC6586, UNC6588, UNC6603, et des acteurs motivés financièrement déployant des malwares comme MINOCAT, SNOWLIGHT, HISONIC, COMPOOD, ANGRYREBEL.LINUX et mineurs XMRig, les chercheurs en cybersécurité confirment une exploitation active et à grande échelle de React2Shell (CVE-2025-55182).

Les attaquants continuent d'exploiter cette faille RCE critique (CVSS 10.0, affectant React 19.0–19.2.0) pour installer des backdoors sur des systèmes Linux, exécuter des commandes arbitraires et cibler les credentials cloud en vue de leur vol.

Bien que des correctifs soient disponibles (React 19.0.1, 19.1.2, 19.2.1+), les menaces persistantes soulignent la nécessité pour les administrateurs d'appliquer des mesures d'atténuation telles que Cloud Armor WAF, de surveiller les IOC des couvertures antérieures et de sécuriser les applications React/Next.js face aux risques de chaîne d'approvisionnement logiciel.

Articles connexes

Illustration depicting the Linux CopyFail vulnerability enabling root access exploits alongside Ubuntu's DDoS-induced outage.

Linux CopyFail exploit threatens root access amid Ubuntu outage

1 mai 2026 Rapporté par l'IA Image générée par IA

A critical Linux vulnerability known as CopyFail, tracked as CVE-2026-31431, allows attackers to gain root access on systems running kernels since 2017. Publicly released exploit code has heightened risks for data centers and personal devices. Ubuntu's infrastructure has been offline for over a day due to a DDoS attack, hampering security communications.

Researchers discover SSHStalker botnet infecting Linux servers

Flare researchers have identified a new Linux botnet called SSHStalker that has compromised around 7,000 systems using outdated exploits and SSH scanning. The botnet employs IRC for command-and-control while maintaining dormant persistence without immediate malicious activities like DDoS or cryptomining. It targets legacy Linux kernels, highlighting risks in neglected infrastructure.

US government issues urgent CopyFail warning as Linux patches roll out

5 mai 2026 Rapporté par l'IA

Four days after the CopyFail (CVE-2026-31431) exploit disclosure disrupted Ubuntu services, the US government warned of its critical risks to Linux systems, urging immediate patching amid public exploit code.

Linux

SSHStalker botnet uses IRC to target Linux servers

Technologie

Veeam patches three critical security flaws in backup servers

Linux

Researchers uncover new SysUpdate malware variant targeting Linux

OpenClaw patches severe vulnerability granting admin access

Developers of the popular AI tool OpenClaw released patches for three high-severity vulnerabilities, including one that allowed attackers with basic pairing privileges to silently gain full administrative control. The flaw, tracked as CVE-2026-33579 and rated up to 9.8 out of 10 in severity, has raised alarms among security experts. Thousands of exposed instances may have been compromised unknowingly.

New SysUpdate malware variant targets Linux systems

18 février 2026 Rapporté par l'IA

A new variant of the SysUpdate malware has been discovered targeting Linux systems, featuring advanced encryption for command-and-control communications. Security researchers at LevelBlue identified the threat during a digital forensics engagement and developed a tool to decrypt its traffic. The malware disguises itself as a legitimate system service to evade detection.

samedi 09 mai 2026 20h17

Les exploitations de React2Shell se poursuivent avec des déploiements à grande échelle de backdoors Linux et vol de credentials cloud

Articles connexes

Linux CopyFail exploit threatens root access amid Ubuntu outage

Researchers discover SSHStalker botnet infecting Linux servers

US government issues urgent CopyFail warning as Linux patches roll out

SSHStalker botnet uses IRC to target Linux servers

Veeam patches three critical security flaws in backup servers

Researchers uncover new SysUpdate malware variant targeting Linux

OpenClaw patches severe vulnerability granting admin access

New SysUpdate malware variant targets Linux systems

New dirty frag exploit grants root access on linux systems

Red Hat directs users to security page for CopyFail vulnerability

Microsoft patches critical ASP.NET Core vulnerability on macOS and Linux

Malicious npm packages harvest crypto keys and secrets

Dell zero-day flaw unpatched for nearly two years

New Linux botnet SSHStalker uses IRC for command-and-control

Ce site utilise des cookies