React2Shell (CVE-2025-55182) Exploitation on AWS EC2 - A Real-World Incident Report

Executive Summary On one of our AWS EC2 servers running a Next.js development environment, we discovered an active exploitation of the React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478). The attacker successfully installed cryptocurrency min...