Fixed in 4 Days. Attacked in Hours.

A bug got a score of 10 out of 10. One web request, no password, and an attacker could run their own code on a React or Next.js server. Within hours of the fix, attackers were already trying it.

Here's what React2Shell was, why even sites that never wrote server functions could be exposed, and the 5 things I'd do on your site.

WHAT I'D DO 1. Find every React and Next.js app you run. 2. Check each version against the official security advisory. 3. Upgrade, then redeploy. 4. If it was exposed, rotate your keys and passwords. 5. Turn on security alerts.

Want me to check your site Message me: hemantinsights.com/contact?type=project

Dramatised explainer. Characters are fictional stand-ins.

Sources: React: react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components Next.js: nextjs.org/blog/CVE-2025-66478 Amazon: aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/

Narration: Kokoro TTS (Apache-2.0). 3D animation, music and sound: original.