Two hacking groups linked to China were quick to exploit a new security vulnerability in React Server Components (RSC). As soon as the vulnerability became public, both groups became active.

A new report from Amazon Web Services (AWS) revealed that two Chinese threat actors, Earth Lamia and Jackpot Panda, tried to take advantage of this critical flaw. Both these names have been involved in cyber attacks before, and this time too, they left no chance.

This vulnerability is known as CVE-2025-55182. People also call it React2Shell. Its special thing is that it allows remote code execution without any authentication. React has fixed this in its versions 19.0.1, 19.1.2, and 19.2.1.

Understanding CVE-2025-55182 (React2Shell)

Lachlan Davidson discovered this vulnerability and reported it to the React team on November 29, 2025. CVE-2025-55182 is a deserialization vulnerability in React Server components. Security researchers have named it React2Shell.

Some important points:

• The CVSS score is 10.0 – meaning it falls in the most severe category.
• Its attack vector? Remote code execution, without any authentication.
• Who is affected? In React 19.x and Next.js 15.x/16.x, especially when using React Server components with App Router.
• One thing to keep in mind is that if your app supports React Server components, it’s vulnerable – even if you don’t use the server functions directly.

Vercel informed Meta and other big cloud providers, including AWS, about this vulnerability in time. For this reason, coordinated patching and protection could be deployed before public disclosure.

Who is using CVE-2025-55182?  

Activity recorded on AWS’s Madpot honeypot infrastructure revealed several IP addresses and systems previously linked to China’s state-backed cyberattackers. Interestingly, Chinese attack groups often share anonymity infrastructure among themselves. Therefore, it is difficult to say with certainty which group is behind any one activity. Meanwhile, the names of two groups like “Earth Lamia” and “Jackpot Panda” have definitely surfaced. Now it has also become common that large anonymization networks are used extensively in Chinese cyber operations. 

Artha Lamia is a China-linked cyber threat group that targets organizations in Latin America, the Middle East, and Southeast Asia. These people take advantage of the vulnerabilities of web applications. So far, they have targeted sectors like financial services, logistics, retail, IT companies, universities, and government organizations.

Jackpot Panda is also a cyber threat group linked to China. Its main focus is on institutions in East and South-East Asia. Its activities are probably related to gathering information related to domestic security and corruption.

Cloudflare Blames Outage on React2Shell Patch

Cloudflare clearly stated in its blog and official statement after the December 5, 2025, outage: “This incident was caused by a config change made to prevent the React2Shell (CVE-2025-55182) vulnerability.”

In other words, React2Shell had a severe RCE (Remote Code Execution) vulnerability. Cloudflare applied a patch to its WAF (Web Application Firewall) to prevent this. But this patch was not compatible with their old proxy system, causing 500 errors and about 25 minutes of outage worldwide.

Cloudflare openly said that this was not a hack or attack from outside. There was a technical glitch while installing the security patch.