Tech
Cyber teams on alert as React2Shell exploitation spreads | Computer Weekly
A remote code execution (RCE) vulnerability in the React JavaScript library, which earlier today caused disruption across the internet as Cloudflare pushed mitigations live on its network, is now being exploited by multiple threat actors at scale, according to reports.
Maintained by Meta, React is an open source resource designed to enable developers to build user interfaces (UIs) for both native and web applications.
The vulnerability in question, assigned CVE-2025-55182 and dubbed React2Shell by the cyber community, is a critically-scored pre-authentication RCE flaw in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of React Server Components that exploits a flaw in how they decode payloads sent to React Function Endpoints.
This means that by crafting a malicious HTTP request to a Server Function endpoint, this means a threat actor could gain the ability to run arbitrary code on the target server.
It was added to the US’ Cybersecurity and Infrastructure Security Agency’s (CISA’s) catalogue on Friday 5 December, and according to Amazon Web Services (AWS) CISO and vice president of security engineering, C.J. Moses, the chief culprits behind the rapid exploitation are thought to be China-nexus threat actors.
Moses cautioned that China’s habit of running shared, large-scale anonymisation infrastructure for multiple state-backed threat actors made definitive attribution challenging, however, following disclosure on Wednesday 3 December, groups tracked as Earth Lamia and Jackpot Panda were observed taking advantage of React2Shell.
“China continues to be the most prolific source of state-sponsored cyber threat activity, with threat actors routinely operationalising public exploits within hours or days of disclosure,” he wrote.
“Through monitoring in our AWS MadPot honeypot infrastructure, Amazon threat intelligence teams have identified both known groups and previously untracked threat clusters attempting to exploit CVE-2025-55182.”
Earth Lamia is well-known for exploiting web application vulnerabilities against organisations primarily located in Latin America, the Middle East, and Southeast Asia, with a particular focus on educational institutions, financial services organisations, government bodies, IT companies, logistics firms, and retailers.
Jackpot Panda, according to AWS, targets its activity at entities in East and Southeast Asia, with its operations aligning to China’s goals relating to corruption and domestic security.
Massive attack
With reports suggesting that there may be over 950,000 servers running vulnerable frameworks such as React and Next.js, Radware threat researchers warned of a massive potential attack surface.
React and Next.js are both well-used thanks to their efficiency and flexibility, while robust ecosystems make them a default choice for many developers – and as such they are found under the bonnet everywhere, from mobile apps and consumer-facing websites to enterprise-grade platforms, said Radware.
“This widespread reliance means a single critical flaw can have cascading consequences for a significant portion of modern web infrastructure,” the Radware team said. “A substantial number of applications across public and private clouds are immediately exploitable, necessitating urgent and widespread action.”
Michael Bell, founder and CEO of Suzu Labs, a penetration testing and AI security specialist, said that hours from disclosure to active exploitation by nation-state actors was the new normal, and matters would likely get worse.
“China-nexus groups have industrializsd their vulnerability response: they monitor disclosures, grab public PoCs – even broken ones – and spray them at scale before most organisations have finished reading the advisory,” he said.
“AWS’s report showing attackers debugging exploits in real-time against honeypots demonstrates this isn’t automated scanning; it’s hands-on-keyboard operators racing to establish persistence before patches roll out.
“With AI tools increasingly capable of parsing vulnerability disclosures and generating exploit code, expect the window between disclosure and weaponization to shrink from hours to minutes,” said Bell.
He added that the earlier Cloudflare outage in service of an emergency patch “tells you everything about the severity calculus here”.
Tech
Silk & Snow Seemingly Cannot Miss—So Don’t Skip This Sale That Ends in 2 Days
I try to test every individual product critically and neutrally, but sometimes a brand comes along that seemingly cannot miss. We have liked everything we’ve tried from Silk & Snow, and right now the company is hosting a Cyber Week Sale that runs through December 7. You can save on some of our favorite bed frames and mattresses that we’ve tested long-term in our own homes, and if you prefer to browse on your own, the sale offers up to 35 percent off site-wide. I’ve rounded up the highlights on WIRED-tested gear below.
WIRED Featured Deals:
Silk & Snow Bed Frame With Drawer Storage for $560 ($140 off)
In our Bed Frame Buying Guide, I say that Silk & Snow could charge more for this bed frame—but right now, it’s 20 percent off. Assembly is a little bit annoying. But the fabric-covered headboard is gorgeous, and the frame is sturdy. My favorite part is the drawer cleverly concealed at the foot of the frame, with its two partitions and its magnetic closure. It does feel a little jarring if you open and close the drawer while your partner is in bed, but I like having extra storage in my room, especially since this frame is too low to the ground to allow for stashing things under it.
Silk & Snow S&S Organic Mattress for $765 ($235 off)
The S&S Organic Mattress is the best organic latex mattress. It’s very soft and offers a lot of pressure relief and support, but the responsive material means it’s better suited to solo sleepers than it is to couples. It feels like a soft, dense marshmallow, per our sleep reviewer Julia Forbes, who advises using lightweight blankets and cooling sheets if you’re a hot sleeper and also raved about the lengthy year-long sleep trial. As part of the Cyber Week sale, you can choose between a free sleep bundle (with a sheet set, a duvet, two microfiber pillows, and a mattress protector) or you can opt out of the bundle to get an extra 10 percent off your mattress.
Silk & Snow Wooden Bed Frame for $1,040 ($260 off)
This bed frame from Silk & Snow made our list of the best Thuma dupes. The Japanese joinery platform frame comes in your choice of natural rubber wood or cortado acacia wood, each in two different finishes. Assembly is pretty easy and doesn’t require any special tools, and you’ll get a robust five-year warranty. The resulting frame is sturdy and gorgeous, though we recommend having a helper around if you need to disassemble the frame to protect the finish on the wood.
Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.
Tech
The Best Lube Is the One You Have Handy. The Second Best Is One of These
Other Good Lubes
Over the years, we’ve tested dozens of different lubes, and some of them are pretty good if not exactly the best in any particular category. For those, we have this section.
Other Good Lubes
Over the years, we’ve tested dozens of different lubes, and some of them are pretty good if not exactly the best in any particular category. For those, we have this section.
LubeLife Water-Based Lubricant for $8: Not only does LubeLife make a stellar silicone lube, but their water-based lubes are great too. At the moment, I’m really enjoying their most recent water-based lube—they have a long and impressive line of these types of lubes—that’s surprisingly long-lasting for something that’s water-based. It’s also super smooth, feeling 100 percent natural, never gets that awful sticky or tacky texture that some water-based lubes develop over time, and upon tasting it, I noticed it had a very slight sweetness to it. While I haven’t used this lube during oral sex, I can definitely see it being a major asset in my performance.
Playground Free Love Lube for $18: If you’re susceptible to UTIs, bacterial vaginosis (BV), or similar infections, then this is the lube for you, as it’s been scientifically proven to both reduce and prevent such vaginal issues. Free Love is also free of glycerin and fragrance, both of which can lead to yeast infections and general irritations. Although Free Love is extremely smooth and makes for a great complement when trying to avoid friction, the biggest selling point is that it will protect you from infections that some other lubes just can’t.
Dame Arousal Serum for $30: I’m not a huge fan of warming or tingling lubes and have yet to try one that makes me a true believer. But Dame’s Arousal Serum comes close. This is a warming, tingling, water-based lube that uses peppermint oil, cinnamon leaf oil, and ginger oil to provide some extra sensation during sex. If you have sensitive skin, I’d leave these products alone, but if you don’t and want to try a stimulating lube, this is the one I’d recommend. Try it on a non-genital area first to ensure you know how your skin will react.
Maude Shine Water-Based Lube for $25: This used to be our top pick. It offers a silky-smooth texture, though it’s on the thicker side for a water-based lube. Thicker water-based lubes typically last longer between applications. Using the thumb test, this lube gives you a slick but smooth cushion between your fingertips, which is a good indicator that it’s going to keep things nice and slick.
Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.
Tech
Here’s What You Should Know About Launching an AI Startup
Julie Bornstein thought it would be a cinch to implement her idea for an AI startup. Her résumé in digital commerce is impeccable: VP of ecommerce at Nordstrom, COO of the startup Stitch Fix, and founder of a personalized shopping platform acquired by Pinterest. Fashion has been her obsession since she was a Syracuse high schooler inhaling spreads in Seventeen and hanging out in local malls. So she felt well-positioned to create a company for customers to discover the perfect garments using AI.
The reality was much harder than she expected. I had breakfast recently with Bornstein and her CTO, Maria Belousova, to learn about her startup, Daydream, funded with $50 million from VCs like Google Ventures. The conversation took an unexpected turn as the women schooled me on the surprising difficulty of translating the magic of AI systems into something people actually find useful.T
Her story helps explain something. My first newsletter of 2025 announced that it would be The Year of the AI App. Though there are indeed many such apps, they haven’t transformed the world as I anticipated. Ever since ChatGPT launched in late 2022, people have been blown away by the tricks performed by AI, but study after study has shown that the technology has not yet delivered a significant boost in productivity. (One exception: coding.) A study published in August found that 19 out of 20 AI enterprise pilot projects delivered no measurable value. I do think that productivity boost is on the horizon, but it’s taking longer than people expected. Listening to the stories of startups like Daydream that are pushing to break through gives some hope that persistence and patience might indeed make those breakthroughs happen.
Fashionista Fail
Bornstein’s original pitch to VCs seemed obvious: Use AI to solve tricky fashion problems by matching customers with the perfect garments, which they’d be delighted to pay for. (Daydream would take a cut.) You’d think the setup would be simple—just connect to an API for a model like ChatGPT and you’re good to go, right? Um, no. Signing up over 265 partners, with access to more than 2 million products from boutique shops to retail giants, was the easy part. It turns out that fulfilling even a simple request like “I need a dress for a wedding in Paris” is incredibly complex. Are you the bride, the mother-in-law, or a guest? What season is it? How formal a wedding? What statement do you want to make? Even when those questions are resolved, different AI models have different views on such things. “What we found was, because of the lack of consistency and reliability of the model—and the hallucinations—sometimes the model would drop one or two elements of the queries,” says Bornstein. A user in Daydream’s long-extended beta test would say something like, “I’m a rectangle, but I need a dress to make me look like an hourglass.” The model would respond by showing dresses with geometric patterns.
Ultimately, Bornstein understood that she had to do two things: postpone the app’s planned fall 2024 launch (though it’s now available, Daydream is still technically in beta until sometime in 2026) and upgrade her technical team. In December 2024 she hired Belousova, the former CTO of Grubhub, who in turn brought in a team of top engineers. Daydream’s secret weapon in the fierce talent war is the chance to work on a fascinating problem. “Fashion is such a juicy space because it has taste and personalization and visual data,” says Belousova. “It’s an interesting problem that hasn’t been solved.”
What’s more, Daydream has to solve this problem twice—first by interpreting what the customer says and then by matching their sometimes quirky criteria with the wares on the catalog side. With inputs like I need a revenge dress for a bat mitzvah where my ex is attending with his new wife, that understanding is critical. “We have this notion at Daydream of shopper vocabulary and a merchant vocabulary, right?” says Bornstein. “Merchants speak in categories and attributes, and shoppers say things like, ‘I’m going to this event, it’s going to be on the rooftop, and I’m going to be with my boyfriend.’ How do you actually merge these two vocabularies into something at run time? And sometimes it takes several iterations in a conversation.” Daydream learned that language isn’t enough. “We’re using visual models, so we actually understand the products in a much more nuanced way,” she says. A customer might share a specific color or show a necklace that they’ll be wearing.
Bornstein says Daydream’s subsequent rehaul has produced better results. (Though when I tried it out, a request for black tuxedo pants showed me beige athletic-fit trousers in addition to what I asked for. Hey, it’s a beta.) “We ended up deciding to move from a single call to an ensemble of many models,” says Bornstein. “Each one makes a specialized call. We have one for color, one for fabric, one for season, one for location.” For instance, Daydream has found that for its purposes, OpenAI models are really good at understanding the world from the clothing point of view. Google’s Gemini is less so, but it is fast and precise.
-
Tech5 days agoGet Your Steps In From Your Home Office With This Walking Pad—On Sale This Week
-
Sports5 days agoIndia Triumphs Over South Africa in First ODI Thanks to Kohli’s Heroics – SUCH TV
-
Fashion5 days agoResults are in: US Black Friday store visits down, e-visits up, apparel shines
-
Entertainment5 days agoSadie Sink talks about the future of Max in ‘Stranger Things’
-
Politics5 days agoElon Musk reveals partner’s half-Indian roots, son’s middle name ‘Sekhar’
-
Tech5 days agoPrague’s City Center Sparkles, Buzzes, and Burns at the Signal Festival
-
Sports5 days agoBroncos secure thrilling OT victory over Commanders behind clutch performances
-
Entertainment5 days agoNatalia Dyer explains Nancy Wheeler’s key blunder in Stranger Things 5





