Tradecraft Tuesday | Inside the React2Shell Exploits

Couldn’t end the year without finding one last big vulnerability. A critical vulnerability in React Server Components (CVE-2025-55182), aka “React2Shell,” has kicked off a new wave of sophisticated cyber threats. Attackers are exploiting this unauthenticated remote code execution flaw to deploy a novel Linux backdoor known as PeerBlight. So, let’s break it down.

Join Huntress analysts Anna, Craig, and Michael, along with Bob Rudis, VP, Data Science, Security Research, & Detection Engineering at GreyNoise, for an in-depth look at this emerging threat. They’ll dissect the mechanics of React2Shell, show you how the PeerBlight backdoor uses the BitTorrent DHT network to create hard-to-takedown Command & Control (C2) infrastructure, and walk through how you can detect these threats in your own environment. Bob will also share his expert perspective on what his team at GreyNoise is seeing in the noise including how attackers are probing and exploiting this vulnerability in the wild.

Don't miss an episode! Lock in your spot for the entire year, here.