CVE-2025-66478Vulnerability
Reported by 2 independent sources · first reported by Zscaler ThreatLabz · last reported
Last reported 10 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182“While CVE-2025-55182 pertains to the upstream implementation in React, you may hear of “CVE-2025-66478” tracking the downstream effects within Next.js applications.”
-
React2Shell: Remote Code Execution Vulnerability (CVE-2025-55182)“…which enabled them to take immediate and proactive measures to mitigate this threat.ANALYST NOTE: Initially, a second vulnerability (CVE-2025-66478) was assigned to Next.js, but it has since been rejected as a CVE due to being a duplicate of CVE-2025-55182 upon further review.”
Indicators reported together
named in the same reports- 38.165.44[.]205in 1 report
- hxxp://38.165.44[.]205/1in 1 report
- 45.76.155[.]14in 1 report
- api.qtss[.]ccin 1 report
- hxxp://207.148.79[.]178:6608/sys.shin 1 report
- 207.148.79[.]178in 1 report
- hxxp://216.158.232[.]43:12000/sex.shin 1 report
- 216.158.232[.]43in 1 report
- hxxp://45.32.158[.]54/5e51aff54626ef7f/x86_64in 1 report
- 45.32.158[.]54in 1 report
- hxxp://45.76.155[.]14/vimin 1 report
- hxxp://keep.camdvr[.]org:8000/d5.shin 1 report
- keep.camdvr[.]orgin 1 report
- hxxp://103.135.101[.]15/wocaosinm.sh;wgetin 1 report
- 103.135.101[.]15in 1 report
- hxxp://103.135.101[.]15/wocaosinm.sh;shin 1 report
- hxxp://vps-zap812595-1.zap-srv[.]com:3000/sex.shin 1 report
- vps-zap812595-1.zap-srv[.]comin 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2025-55182, CVE-2025-30406
Thanks — we review every report.