---
title: Hackers Compromise 700+ Next.js Servers Using React2Shell Exploit
description: Massive UAT-10608 hack compromises 700+ servers via React2Shell flaw. Update Next.js apps now to protect credentials.
canonical_url: https://codekeeper.co/ticker/massive-hack-exploits-react2shell-flaw
---

# Hackers Compromise 700+ Next.js Servers Using React2Shell Exploit

Massive UAT-10608 hack compromises 700+ servers via React2Shell flaw. Update Next.js apps now to protect credentials.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Apr 3, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybersecurity researchers at Cisco Talos discovered a massive attack by hacker group UAT-10608, which has compromised over 700 servers in just 24 hours. The attackers are exploiting React2Shell (CVE-2025-55182), a critical remote code execution flaw in Next.js applications that requires no passwords or user interaction. The hackers use automated tools to scan for vulnerable servers, then deploy malicious scripts that steal credentials like digital vacuum cleaners. Their custom "NEXUS Listener" dashboard shows devastating results: 90% of compromised hosts lost database credentials, 80% had SSH keys stolen, plus AWS credentials, Stripe payment keys, and GitHub tokens were taken. Companies must immediately update Next.js applications and change all passwords, API keys, and security tokens. **Source:** [Cybersecurity News](https://cybersecuritynews.com/700-next-js-hosts-exploited/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-hack-exploits-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cloud and SaaS Environments Are Now Attackers' Favorite Targets Aug 11, 2026](https://codekeeper.co/ticker/cybersecurity-threats-2026-cloud-saas-ai)

[Massive Supply-Chain Attack Hits 440+ npm Packages in Under Four Hours Aug 11, 2026](https://codekeeper.co/ticker/github-account-hijack-infects-npm-packages)

[Data breaches Minnesota Supreme Court Hit by Third-Party Data Breach Sep 4, 2026](https://codekeeper.co/ticker/minnesota-courts-data-breach-thomson-reuters)

[Splunk Enterprise Hit by Critical Pre-Auth RCE Vulnerability Scoring 9.8 CVSS Aug 12, 2026](https://codekeeper.co/ticker/splunk-enterprise-vulnerability-cve-2026-20253)