React2Shell: Because Apparently the Flock Just Can't Stop Clicking Things
Look. I've been awake for 31 hours now. My third cup of coffee is cold. And I just got pinged about ANOTHER hole in the fence that the Wolves are actively using to dump parasites all over our Linux pastures.
React2Shell. That's what they're calling it. Real creative.
According to the folks at Palo Alto Networks Unit 42 and NTT Security, the Coyotes out there have figured out this vulnerability is basically an open gate. They're waltzing right through and dropping two lovely flea infestations: KSwapDoor and ZnDoor.
Oh, and KSwapDoor? "Professionally engineered with stealth in mind." Great. Fantastic. The Wolves are hiring better developers than we are. They've got a whole remote access parasite that's designed to burrow deep and stay quiet while it phones home.
ZnDoor is the other one. Because why settle for one infestation when you can have two?
This is what happens when nobody wants to shear their systems. The Lambs keep grazing, the Shepherds keep asking for quarterly reports instead of approving the dipping budget, and meanwhile there's a professionally engineered tick collection setting up shop in your backend.
I submitted a ticket about this three weeks ago. Status: "Under Review."
Cool. Cool cool cool.
Remediation
- Patch your systems. Apply the ointment. Do the shearing. Whatever metaphor gets you to actually update.
- Check your Linux boxes for signs of KSwapDoor or ZnDoor. If you don't know how, maybe ask someone who's slept this week.
- Monitor outbound traffic for weird callbacks. The parasites like to chat with their Wolf handlers.
- Tell the Shepherds this is urgent. They won't listen, but at least you'll have the email trail for when everything catches fire.
I'm going to go stare at the Electric Fence logs now. Don't @ me.
Original Report: https://thehackernews.com/2025/12/react2shell-vulnerability-actively.html