Skip to content
Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

Ravie LakshmananApr 02, 2026Vulnerability / Threat Intelligence A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command… 

Money transfer app Duc exposed thousands of driver’s licenses and passports to the open web

Money transfer app Duc exposed thousands of driver’s licenses and passports to the open web

A publicly accessible Amazon-hosted storage server allowed anyone with a web browser to access potentially hundreds of thousands of people’s personal data without needing a password. This included driver’s licenses, passports, and other personal information…