Week of December 1, 2025: React2Shell flaw hits the KEV list, and CISA details China's BRICKSTORM backdoor

What mattered to security leaders in the week of December 1, 2025? The React team disclosed CVE-2025-55182, a maximum-severity remote code execution flaw in React Server Components, on Wednesday, December 3, and by Friday CISA had evidence it was being exploited. On Thursday CISA, the NSA and Canada's Cyber Centre described BRICKSTORM, a backdoor Chinese state-sponsored actors were using for long-term access to VMware vSphere and Windows environments.

React2Shell: a critical React Server Components flaw is exploited within days

The flaw, nicknamed React2Shell, is an unsafe deserialization bug in React Server Components versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0 that can give unauthenticated attackers code execution on the application server; React 19.2.1 fixes it. When Help Net Security reported it on December 4 there was no public exploit, but on December 5 CISA added it to the KEV catalog on evidence of active exploitation. Frameworks and bundlers that depend on React also needed updates, so inventorying Next.js and similar apps was the first job. (Help Net Security, CISA)

Cloudflare's React mitigation triggers a 25-minute outage

At 08:47 UTC on December 5 part of Cloudflare's network started failing, affecting customers that account for about 28% of the HTTP traffic it serves, until a revert at 09:12. Cloudflare said no attack was involved: the failure came from changes to its body parsing logic, made while raising its WAF buffer from 128KB to 1MB to protect customers against the React vulnerability. It was the company's second outage in under three weeks, after November 18. Emergency WAF rule changes carry their own availability risk and deserve the same change control as code. (Cloudflare)

CISA, NSA and Canada expose the BRICKSTORM backdoor

On December 4 CISA said it was aware of ongoing intrusions in which Chinese state-sponsored actors used BRICKSTORM for persistence, mainly against government services and facilities and IT sector organizations. The malware hides its traffic with layered encryption and DNS-over-HTTPS, runs a SOCKS proxy for lateral movement and reinstalls itself if disrupted. In one case the actors moved from a DMZ web server to an internal VMware vCenter server before planting it. A joint malware analysis report examines that sample and seven others. vCenter hosts rarely run endpoint agents, which is exactly why they need dedicated monitoring. (CISA)

Google patches two Android Framework flaws under targeted attack

Google's December Android security bulletin fixed 51 vulnerabilities, including CVE-2025-48633, which apps can use to access sensitive information, and CVE-2025-48572, a privilege escalation bug; Google said both may be under limited, targeted exploitation. The December 1 patch level covers Android 13 through 16. Mobile device management teams should check how quickly handset makers push the fix to managed fleets. (Help Net Security)

German and Swiss police take down the Cryptomixer laundering service

Authorities in Germany and Switzerland, supported by Europol and Eurojust, shut down Cryptomixer and seized more than 25 million euros in Bitcoin, three servers in Zurich, the cryptomixer.io domain and over 12 terabytes of data, according to the December 1 announcement of Operation Olympia. The action itself took place in the last week of November. The service had been used to launder proceeds for ransomware groups and dark web markets, so its logs could help trace past extortion payments. (Help Net Security)

Allied agencies publish principles for putting AI into operational technology

CISA and the Australian Signals Directorate's Australian Cyber Security Centre, with other partners, released Principles for the Secure Integration of Artificial Intelligence in Operational Technology on December 3. The guidance centers on machine learning, large language models and AI agents, and asks operators to train staff on AI risk, assess each OT use case, set up governance with continuous model testing, and keep safety oversight in place. Plants being pitched AI copilots now have a government reference to test vendor claims against. (CISA)