RondoDox Botnet Exploits React2Shell Flaw to Hijack IoT Devices and Servers
TL;DR
Cybersecurity researchers have uncovered a nine-month campaign where the RondoDox botnet exploited the critical React2Shell vulnerability (CVE-2025-55182) to hijack IoT devices and web servers, deploying malware, cryptocurrency miners, and Mirai variants, with the threat still active as of December 2025. Organizations are urged to update vulnerable software, segment IoT devices, and enhance monitoring to prevent infection.
Topics:businessnetwork-security#botnet#iot-security#network-security#react2shell#rondodox#vulnerability-exploitation
- RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers The Hacker News
- Best of 2025: CVE-2025-29927 – Understanding the Next.js Middleware Vulnerability Security Boulevard
- 59K Servers Hacked in 48 Hours: Inside Operation PCPcat eSecurity Planet
- React2Shell under attack: RondoDox Botnet spreads miners and malware Security Affairs
- React2Shell, Shai-Hulud 2.0, Gogs Zero-Day & Tika RCE wiz.io
Want the full story? Read the original reporting
Read on The Hacker News