Cloud Attackers Now Prefer Vulnerability Exploits Over Credentials
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution flaw (CWE-502, deserialization of untrusted data) in React Server Components, specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. It is triggered when the vulnerable code unsafely deserializes payloads from HTTP requests sent to Server Function endpoints, requiring no authentication or user interaction. An attacker gains arbitrary code execution on the affected server (CVSS scope changed, with high impact to confidentiality, integrity, and availability), and reporting notes a campaign in which hackers used the flaw to breach 766 Next.js hosts and steal credentials. Any React/Next.js application exposing Server Functions with the affected React versions is in scope, which given the ubiquity of React and Next.js is a very large deployed base. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoC/scanner repositories are available, and coverage has dubbed the flaw React2Shell. Do: Upgrade the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the vendor-patched releases (any version later than the vulnerable 19.0.0, 19.1.0, 19.1.1, and 19.2.0 line) and update Next.js per Vercel's advisory; as a KEV entry, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Audit internet-exposed Server Function endpoints for the vulnerable React versions and review logs for exploitation activity, including the reported campaign that breached 766 Next.js hosts and stole credentials, then rotate any exposed credentials. | 10.0 | 100% | KEV ransomware PoC ×7 |
| mass≈1M+ internet-facing Next.js/React Server Components deployments (order-of-magnitude estimate) |
Full article459 words · extracted from infosecurity-magazine.com · click to collapse
Google Cloud has warned that threat actors targeting cloud environments now favor campaigns which gain initial access by exploiting software vulnerabilities over credential-based attacks.
Published on 9 March, the Google Cloud Office of the CISO's H1 2026 Google Cloud Threat Horizons Report, details how the cloud threat landscape evolved based on how attackers attempted to target Google Cloud services during the second half of 2025.
“Our team has observed a fundamental shift in the landscape,” said Crystal Lister, security advisor and head of cloud threat horizons report program for Office of the CISO, at Google Cloud.
Traditionally, threat actors have relied on weak or missing credentials and misconfigurations to gain access to Google Cloud environments.
However, the second half of 2025 saw threat actors increasingly turn towards exploiting unpatched third-party vulnerabilities.
In total, third-party software-based entry accounted for 44.5% of primary entry vectors during the second half of 2025. This represents a significant increase from the 2.9% observed during the first half of the year.
In comparison, abuse of weak or absent credentials as an entry point dropped from 47.1% in the first half of the year, down to 27.2% in the second half.
React2Shell Top Targeted Vulnerability
One of the most commonly software vulnerabilities used to target cloud services was CVE-2025-55182, more commonly known as React2Shell, a critical remote code execution vulnerability in React Server Components.
The vulnerability can enable attackers to take control of servers and compromise data. It has been tied to cyber-attacks by nation-state threat actors linked to both North Korea and China.
“While Google Cloud’s underlying infrastructure remains secure, threat actors are successfully targeting unpatched applications and permissive user-defined firewall rules,” said Google Cloud.
The company also warned that attackers have also got quicker at the mass exploitation of software vulnerabilities following their public disclosure.
“To mitigate these risks across any environment, cloud defenders should focus on identity access controls, using centralized visibility tools to secure data, and automated posture enforcement,” said Google.
According to the report, the window between vulnerability disclosure and mass exploitation collapsed by “an order of magnitude” from weeks to just days. Ultimately, if organizations haven’t patched vulnerabilities within days of the disclosure, then their cloud services are vulnerable to attackers.
For example, Google Cloud noted that within just 48 hours of the public disclosure of React2Shell in December 2025, multiple threat actors had already exploited the vulnerability to infect victims with cryptocurrency mining malware.
Google has issued advice to organizations on what they should do to avoid falling victim to newly disclosed vulnerabilities.
“Defensively, organizations should pivot from manual patching to automated defenses—such as patching the Web Application Firewall (WAF)—to neutralize exploits at the network edge before software updates can be applied,” the company recommended.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cloud-attackers-prefer-exploits/