Andrew Shikiar

React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged federal agencies to patch the recent React2Shell vulnerability by December 12, 2025, amid reports of widespread exploitation. The critical vulnerability, tracked as CVE-2025-55182 (CVSS score: 10.0), affects the React Server Components (RSC) Flight protocol. The underlying cause of the issue is an unsafe deserialization that allows an attacker to inject malicious logic that the server executes in a privileged context. It also affects other frameworks, including Next.js, Waku, Vite, React Router, and RedwoodSDK. "A single, specially crafted HTTP request is sufficient; there is no authentication requirement, user interaction, or elevated permissions involved," Cloudforce One, Cloudflare's threat intelligence team, said. "Once successful, the attacker can execute arbitrary, privileged JavaScript on the affected server." https://lnkd.in/e4N74-af

5

1 Comment

(( Breaking News )) 🚨 Today, we shared how Armis worked with Copeland to address 10 newly discovered vulnerabilities impacting mission-critical equipment 🚨 Discovered by Armis Labs and collectively named “Frostbyte10���, these vulnerabilities were found in Copeland’s widely used E2 and E3 controllers. Deployed across many global enterprises, these devices are essential for managing HVAC, BMS and commercial refrigeration systems in industries including food retail, pharmaceuticals, and cold chain logistics. By prioritizing responsible disclosure, a transparent process, and early warnings to the community, together we turned a potential threat into an opportunity for stronger, safer systems. Our thanks to Copeland for the collaboration. Today's disclosure is a reminder of the risk embedded in legacy systems that were never designed with modern #CyberThreats in mind. 🔗 Read more in our blog: https://lnkd.in/eZiM6R44 #CPS #Collaboration #Vulnerabilities #OTSecurity #VulnerabilityManagement #CriticalInfrastructure

38

1 Comment

Keeping the momentum rolling for LOKRA Asset Solutions... AegisTrace is more than a tool tracker. We are building the infrastructure for public asset accountability. Consider the unattended laundromat. If a washing machine breaks at 10 PM on a Tuesday, the owner might not find out until they visit the site days later. With a LOKRA tag attached, the customer becomes the sensor. They scan a customized tag with a label that reads "Not working? Scan this tag!", report the fault and the owner is notified in seconds. This allows a small business to maintain a professional service standard without needing a physical presence on site at all times. Portable sanitation is another high stakes use case. Portaloos on construction sites or at major events require strict servicing schedules to remain compliant with health and safety standards. Any worker or attendee can scan the registry tag to request a cleaning or report damage. This provides the asset owner with a live map of where their attention is needed most and creates a verifiable log of when the request was made and when it was resolved. Viable usage even exists for life saving equipment like public access defibrillators. These units often sit in cabinets for weeks or even months without interaction. If a battery dies or the pads expire, the unit becomes useless in an emergency. By tagging these assets, anyone can scan the QR code to verify that the maintenance is up to date. The public record shows a "last maintained" field and allows the user to alert the recorded contact if the unit appears tampered with. This moves the responsibility from a hidden spreadsheet to a public safety ledger. If a unit has not been serviced within a calibrated timeframe, the owner or delegated service agent will receive a reminder both by email and in their portal. This is the power of a forensic digital twin. It turns static objects into active nodes in a governance network. The engine is live and the hardware is ready. We are currently funding our first industrial production run on Kickstarter. Join the standard for physical asset governance today. Campaign Link: http://kck.st/4bXMfOa #AssetSecurity #DigitalTracking #AssetSafety #ChainOfCustody #BurdenOfProof #LOKRA #AegisTrace

1