React2Shell and related RSC vulnerabilities threat brief- early exploitation activity and threat actor techniques

This post details the immediate threat intelligence and WAF rule deployment following the disclosure of the React2Shell vulnerability (CVE-2025-55182) and related RSC vulnerabilities (CVE-2025-55183, CVE-2025-55184). It describes the observed exploitation tactics and techniques used by threat actors, including the use of vulnerability scanners and asset discovery platforms, and the filtering of targets based on application metadata and SSL certificate attributes. It also details the specific WAF rules deployed by Cloudflare to mitigate these threats, including rules for scanning detection and exploit bypasses. The post quantifies the volume of detected activity, showing millions of hits per hour and thousands of unique IPs probing for the vulnerability.