Tech
Cyber teams on alert as React2Shell exploitation spreads | Computer Weekly
A remote code execution (RCE) vulnerability in the React JavaScript library, which earlier today caused disruption across the internet as Cloudflare pushed mitigations live on its network, is now being exploited by multiple threat actors at scale, according to reports.
Maintained by Meta, React is an open source resource designed to enable developers to build user interfaces (UIs) for both native and web applications.
The vulnerability in question, assigned CVE-2025-55182 and dubbed React2Shell by the cyber community, is a critically-scored pre-authentication RCE flaw in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of React Server Components that exploits a flaw in how they decode payloads sent to React Function Endpoints.
This means that by crafting a malicious HTTP request to a Server Function endpoint, this means a threat actor could gain the ability to run arbitrary code on the target server.
It was added to the US’ Cybersecurity and Infrastructure Security Agency’s (CISA’s) catalogue on Friday 5 December, and according to Amazon Web Services (AWS) CISO and vice president of security engineering, C.J. Moses, the chief culprits behind the rapid exploitation are thought to be China-nexus threat actors.
Moses cautioned that China’s habit of running shared, large-scale anonymisation infrastructure for multiple state-backed threat actors made definitive attribution challenging, however, following disclosure on Wednesday 3 December, groups tracked as Earth Lamia and Jackpot Panda were observed taking advantage of React2Shell.
“China continues to be the most prolific source of state-sponsored cyber threat activity, with threat actors routinely operationalising public exploits within hours or days of disclosure,” he wrote.
“Through monitoring in our AWS MadPot honeypot infrastructure, Amazon threat intelligence teams have identified both known groups and previously untracked threat clusters attempting to exploit CVE-2025-55182.”
Earth Lamia is well-known for exploiting web application vulnerabilities against organisations primarily located in Latin America, the Middle East, and Southeast Asia, with a particular focus on educational institutions, financial services organisations, government bodies, IT companies, logistics firms, and retailers.
Jackpot Panda, according to AWS, targets its activity at entities in East and Southeast Asia, with its operations aligning to China’s goals relating to corruption and domestic security.
Massive attack
With reports suggesting that there may be over 950,000 servers running vulnerable frameworks such as React and Next.js, Radware threat researchers warned of a massive potential attack surface.
React and Next.js are both well-used thanks to their efficiency and flexibility, while robust ecosystems make them a default choice for many developers – and as such they are found under the bonnet everywhere, from mobile apps and consumer-facing websites to enterprise-grade platforms, said Radware.
“This widespread reliance means a single critical flaw can have cascading consequences for a significant portion of modern web infrastructure,” the Radware team said. “A substantial number of applications across public and private clouds are immediately exploitable, necessitating urgent and widespread action.”
Michael Bell, founder and CEO of Suzu Labs, a penetration testing and AI security specialist, said that hours from disclosure to active exploitation by nation-state actors was the new normal, and matters would likely get worse.
“China-nexus groups have industrializsd their vulnerability response: they monitor disclosures, grab public PoCs – even broken ones – and spray them at scale before most organisations have finished reading the advisory,” he said.
“AWS’s report showing attackers debugging exploits in real-time against honeypots demonstrates this isn’t automated scanning; it’s hands-on-keyboard operators racing to establish persistence before patches roll out.
“With AI tools increasingly capable of parsing vulnerability disclosures and generating exploit code, expect the window between disclosure and weaponization to shrink from hours to minutes,” said Bell.
He added that the earlier Cloudflare outage in service of an emergency patch “tells you everything about the severity calculus here”.
Tech
Huawei: agent-oriented mobile networks to define Agent Verse | Computer Weekly
Two years after it proposed the transition from the mobile internet era to the mobile artificial intelligence (AI) era, leading to the rapid adoption of agents in B2B applications and 30 million agents applied over the past 12 months, Huawei has introduced the Agent Verse, predicting a 10,000-fold increase in agent-handled work in networks by 2030.
The proposal of a new paradigm for communications came on the back of the comms tech giant’s Agentic Core Summit at MWC 2026, which centred on the strategic theme of building an agentic network with device-network-service synergy.
At the summit, Huawei revealed that it had worked with global mobile trade association the GSMA and a range of operators and industry organisations across the Middle East, Asia Pacific, Europe, Latin America and other regions to explore AI-driven advancements for the core network. Together, they unanimously agreed that the 5G core network has entered into “a new phase” called the Agentic Core.
Huawei’s Agentic Core system integrates AI into mobile internet, voice, operations and maintenance (O&M) and telco cloud infrastructure to allow networks to evolve and main service offerings to be reshaped. Huawei sees AI as extending a core network with three “transformative” abilities: real-time experience awareness; global experience evaluation and resource coordination; and intelligent interaction and execution.
This architecture is designed to give rise to a “network brain” that drives a closed-loop experience monetisation model where experiences are definable and assessable, service offerings are marketable, quality is guaranteed and exclusive user identities are perceptible.
The intelligent O&M part of the solution is built to transform network operations into an automated and intelligent ecosystem, driving the core network toward Autonomous Network (AN) L4 Phase 2. Phase 1 focuses on the intelligent assistant, NOEMate, which delivers automated closed-loop management for both faults and changes. Building on this, Phase 2 introduces hierarchical autonomy and builds an unmanned factory, achieving full single-domain autonomy within the core network.
Looking toward the 6G era, Huawei Agentic Core also supports ubiquitous AI agent access, building an agent-based communication network that spans across devices and ecosystems. The Cloud Core Network is designed for an evolving communication infrastructure that will act as an interchange for AI agent network.
And these, said Huawei Eric Zhao, vice-president and CMO of Huawei’s wireless solution, would operate in the Agent Verse: “Mobile AI is sparking a paradigm shift across the communications industry. With a trillion-scale surge in Agent Verse connections on the horizon, mobile networks need an urgent upgrade.
“To unlock the full potential of 5G-Advanced, the industry should accelerate end-to-end upgrades and innovation, building multidimensional network capabilities that can meet the demands ahead.”
At MWC, Huawei argued that agents were reshaping mobile network demands – for example, by evolving into engines of industrial automation and broad societal change. It offered the example of productivity agents making fully automated manufacturing possible through autonomous learning and the precise coordination of thousands of robots. It calculated that by 2030, the global market is expected to reach trillions of intelligent connections worldwide.
Zhao added: “AI’s development has gone wide and far beyond our imagination, and it is now becoming clear that the application of AI will be [through] agents. We believe that in the future, every industry, terminal, organisation and individual will be served by agents – and this is why we propose the Agent Verse. Just in last year alone, there was 30 million agents applied in different industries, significantly improving the productivities of verticals; the adoption pace of agents is incredibly fast.
“It is estimated that by 2030, the amount of work handled by agents will grow by 10,000 times. Agents adoption means the introduction of changes in communication methods and communication objects. That means, in the future, agents will introduce new interactions, agents will interact with people, agents will interact with agents. This is why we think that the time has changed and the wireless industry needs to be prepared to welcome new services.”
Tech
Yann LeCun Raises $1 Billion to Build AI That Understands the Physical World
Advanced Machine Intelligence (AMI), a new Paris-based startup cofounded by Meta’s former chief AI scientist Yann LeCun, announced Monday it has raised more than $1 billion to develop AI world models.
LeCun argues that most human reasoning is grounded in the physical world, not language, and that AI world models are necessary to develop true human-level intelligence. “The idea that you’re going to extend the capabilities of LLMs [large language models] to the point that they’re going to have human-level intelligence is complete nonsense,” he said in an interview with WIRED.
The financing, which values the startup at $3.5 billion, was co-led by investors such as Cathay Innovation, Greycroft, Hiro Capital, HV Capital, and Bezos Expeditions. Other notable backers include Mark Cuban, former Google CEO Eric Schmidt, and French billionaire and telecommunications executive Xavier Niel.
AMI (pronounced like the French word for friend) aims to build “a new breed of AI systems that understand the world, have persistent memory, can reason and plan, and are controllable and safe,” the company says in a press release. The startup says it will be global from day one, with offices in Paris, Montreal, Singapore, and New York, where LeCun will continue working as a New York University professor in addition to leading the startup. AMI will be the first commercial endeavor for LeCun since his departure from Meta in November 2025.
LeCun’s startup represents a bet against many of the world’s biggest AI labs like OpenAI, Anthropic, and even his former workplace, Meta, which believe that scaling up LLMs will eventually deliver AI systems with human-level intelligence or even superintelligence. LLMs have powered viral products such as ChatGPT and Claude Code, but LeCun has been one of the AI industry’s most prominent researchers speaking out about the limitations of these AI models. LeCun is well known for being outspoken, but as a pioneer of modern AI that won a Turing award back in 2018, his skepticism carries weight.
LeCun says AMI aims to work with companies in manufacturing, biomedical, robotics, and other industries that have lots of data. For example, he says AMI could build a realistic world model of an aircraft engine and work with the manufacturer to help them optimize for efficiency, minimize emissions, or ensure reliability.
AMI was cofounded by LeCun and several leaders he worked with at Meta, including the company’s former director of research science, Michael Rabbat; former vice president of Europe, Laurent Solly; and former senior director of AI research, Pascale Fung. Other cofounders include Alexandre LeBrun, former CEO of the AI health care startup Nabla, who will serve as AMI’s CEO, and Saining Xie, a former Google DeepMind researcher who will be the startup’s chief science officer.
The Case for World Models
LeCun does not dismiss the overall utility of LLMs. Rather, in his view, these AI models are simply the tech industry’s latest promising trend, and their success has created a “kind of delusion” among the people who build them. “It’s true that [LLMs] are becoming really good at generating code, and it’s true that they are probably going to become even more useful in a wide area of applications where code generation can help,” says LeCun. “That’s a lot of applications, but it’s not going to lead to human-level intelligence at all.”
LeCun has been working on world models for years inside of Meta, where he founded the company’s Fundamental AI Research lab, FAIR. But he’s now convinced his research is best done outside the social media giant. He says it’s become clear to him that the strongest applications of world models will be selling them to other enterprises, which doesn’t fit neatly into Meta’s core consumer business.
As AI world models like Meta’s Joint-Embedding Predictive Architecture (JEPA) became more sophisticated, “there was a reorientation of Meta’s strategy where it had to basically catch up with the industry on LLMs and kind of do the same thing that other LLM companies are doing, which is not my interest,” says LeCun. “So sometime in November, I went to see Mark Zuckerberg and told him. He’s always been very supportive of [world model research], but I told him I can do this faster, cheaper, and better outside of Meta. I can share the cost of development with other companies … His answer was, OK, we can work together.”
Tech
Nvidia Is Planning to Launch an Open-Source AI Agent Platform
Nvidia is planning to launch an open-source platform for AI agents, people familiar with the company’s plans tell WIRED.
The chipmaker has been pitching the product, referred to as NemoClaw, to enterprise software companies. The platform will allow these companies to dispatch AI agents to perform tasks for their own workforces. Companies will be able to access the platform regardless of whether their products run on Nvidia’s chips, sources say.
The move comes as Nvidia prepares for its annual developer conference in San Jose next week. Ahead of the conference, Nvidia has reached out to companies including Salesforce, Cisco, Google, Adobe, and CrowdStrike to forge partnerships for the agent platform. It’s unclear whether these conversations have resulted in official partnerships. Since the platform is open source, it’s likely that partners would get free, early access in exchange for contributing to the project, sources say. Nvidia plans to offer security and privacy tools as part of this new open-source agent platform.
Nvidia did not respond to a request for comment. Representatives from Cisco, Google, Adobe, and CrowdStrike also did not respond to requests for comment. Salesforce did not provide a statement prior to publication.
Nvidia’s interest in agents comes as people are embracing “claws,” or open-source AI tools that run locally on a user’s machine and perform sequential tasks. Claws are often described as self-learning, in that they’re supposed to automatically improve over time. Earlier this year, an AI agent known as OpenClaw—which was first called Clawdbot, then Moltbot—captivated Silicon Valley due to its ability to run autonomously on personal computers and complete work tasks for users. OpenAI ended up acquiring the project and hiring the creator behind it.
OpenAI and Anthropic have made significant improvements in model reliability in recent years, but their chatbots still require hand-holding. Purpose-built AI agents or claws, on the other hand, are designed to execute multiple steps without as much human supervision.
The usage of claws within enterprise environments is controversial. WIRED previously reported that some tech companies, including Meta, have asked employees to refrain from using OpenClaw on their work computers, due to the unpredictability of the agents and potential security risks. Last month a Meta employee who oversees safety and alignment for the company’s AI lab publicly shared a story about an AI agent going rogue on her machine and mass deleting her emails.
For Nvidia, NemoClaw appears to be part of an effort to court enterprise software companies by offering additional layers of security for AI agents. It’s also another step in the company’s embrace of open-source AI models, part of a broader strategy to maintain its dominance in AI infrastructure at a time when leading AI labs are building their own custom chips. Nvidia’s software strategy until now has been heavily reliant on its CUDA platform, a famously proprietary system that locks developers into building software for Nvidia’s GPUs and has created a crucial “moat” for the company.
Last month The Wall Street Journal reported that Nvidia also plans to reveal a new chip system for inference computing at its developer conference. The system will incorporate a chip designed by the startup Groq, which Nvidia entered into a multibillion-dollar licensing agreement with late last year.
Paresh Dave and Maxwell Zeff contributed to this report.
-
Politics3 days agoIndia let Iran warship dock the day US sank another off Sri Lanka, say officials
-
Sports3 days agoPakistan set for FIH Pro League debut | The Express Tribune
-
Entertainment3 days agoHarry Styles kicks off new era with ‘One Night Only’ comeback show
-
Business1 week agoLabour parliamentarians urge UK Government to oppose Rosebank oil field
-
Business3 days agoRestaurant group changes name after bid to buys pubs across the UK
-
Business4 days agoHome heating oil: ‘Most of my pension has gone on home heating oil’
-
Tech1 week agoThe 5 Big ‘Known Unknowns’ of Donald Trump’s New War With Iran
-
Sports1 week agoUSA vs. Argentina (Mar 1, 2026) Live Score – ESPN
