IR Trends Q4 2025: Exploitation remains dominant, phishing campaign targets Native American tribal organizations

🗓️ 29 Jan 2026 11:00:07Reported by Dave LiebenbergType

talosblog🔗 blog.talosintelligence.com👁 21 Views

Threat actors exploit public-facing apps; phishing targets Native American tribal organizations.

Reporter	Title	Published	Views	Family All 1004
Wallarm Lab	Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)	8 Dec 202516:00	–	wallarmlab
Wallarm Lab	Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows	4 Dec 202510:35	–	wallarmlab
Wiz blog	React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182	8 Dec 202517:18	–	wizblog
Wiz blog	React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability	3 Dec 202515:57	–	wizblog
GithubExploit	Exploit for Deserialization of Untrusted Data in Facebook React	31 Dec 202514:20	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Facebook React	9 Dec 202506:46	–	githubexploit
GithubExploit	Exploit for CVE-2025-55182	4 Dec 202501:26	–	githubexploit
GithubExploit	Exploit for CVE-2025-55182	5 Dec 202517:47	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Facebook React	7 Jan 202620:51	–	githubexploit
GithubExploit	react2shell-poc	10 Aug 202614:16	–	githubexploit

29 Jan 2026 11:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.110

EPSS0.99802

SSVC

public facing applications exploitation campaigns phishing campaigns native american tribal organizations credential harvesting