---
title: Hackers Exploit React2Shell Flaw to Compromise 700+ Next.js Servers
description: Massive attack by UAT-10608 compromises 700+ Next.js servers via React2Shell flaw, stealing credentials. Update apps now.
canonical_url: https://codekeeper.co/ticker/massive-nextjs-attack-react2shell-flaw
---

# Hackers Exploit React2Shell Flaw to Compromise 700+ Next.js Servers

Massive attack by UAT-10608 compromises 700+ Next.js servers via React2Shell flaw, stealing credentials. Update apps now.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Apr 4, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybersecurity researchers at Cisco Talos discovered a massive attack by hacker group UAT-10608 that has compromised over 700 Next.js servers using the React2Shell vulnerability (CVE-2025-55182). The attackers exploit this remote code execution flaw to automatically steal credentials without needing passwords or user interaction. In just 24 hours, their "NEXUS Listener" dashboard recorded 766 compromised hosts. Over 90% had database credentials stolen, nearly 80% lost SSH keys, and hackers also grabbed AWS credentials, Stripe payment keys, and GitHub tokens. The stolen data gives attackers access to private user information, financial records, and the ability to move across company networks or take over entire cloud environments. Companies using Next.js should immediately update their applications and change all passwords and security tokens. **Source:** [Cybersecurity News](https://cybersecuritynews.com/700-next-js-hosts-exploited/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-nextjs-attack-react2shell-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Critical N-Central Flaw Gives Hackers Full Admin Access to MSP Platforms Aug 11, 2026](https://codekeeper.co/ticker/critical-n-central-rmm-vulnerability-cve-2026-18577)

[Coordinated Cyberattack Hits 30+ Minnesota Water Systems in 48 Hours Aug 11, 2026](https://codekeeper.co/ticker/minnesota-water-systems-cyberattack)

[FBI Agents Fear for Their Safety After Massive Data Breach Sep 28, 2026](https://codekeeper.co/ticker/shinyhunters-fbi-data-breach-threat)

[CrowdSec Source Code Stolen in TanStack Supply Chain Attack Sep 26, 2026](https://codekeeper.co/ticker/crowdsec-supply-chain-breach-github-repositories)