Security researchers at Sysdig have observed new campaigns exploiting React2Shell which appear to have the hallmarks of North Korean hackers. React2Shell is a remote code execution vulnerability in React Server Components (RSCs). Tracked as CVE-2025-55182, the flaw has a maximum severity rating with a CVSS score of 10.0. Publicly disclosed on December 3, the vulnerability impacts version 19 of the React open source library for creating application user interfaces as well as many other related frameworks, including Next.js, Waku, React Router and RedwoodSDK. Quickly after it was made public, Amazon Web Services (AWS) confirmed that threat groups including Earth Lamia and Jackpot Panda, both linked to Chinese state interests, were among those launching exploitation attempts. Other threat…