Last seen May 18, 2026

AI/LLM-Generated Malware Used to Exploit React2Shell

An AI-generated malware sample exploited CVE-2025-55182, known as React2Shell, within a Docker honeypot with an exposed daemon. This resulted in remote code execution, allowing the deployment of an XMRig cryptominer on over ninety compromised hosts and demonstrating the operational value of LLMs for low-skill adversaries.

Technical Severity
Low severity
Lifecycle Status

STABLE

Sources

What Happened

An AI-generated malware sample exploited CVE-2025-55182, known as React2Shell, within a Docker honeypot with an exposed daemon. This resulted in remote code execution, allowing the deployment of an XMRig cryptominer on over ninety compromised hosts and demonstrating the operational value of LLMs for low-skill adversaries.

Why This Matters

Publisher reporting describes a security event affecting for. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether for is present in your environment, compare your versions against the report, and apply available vendor patches or mitigations.

Exposure

My Interests Exposure

Exposure unknown

Recommended Response
Last Seen

May 18, 2026 12:30

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

Synack2026 State of Vulnerabilities ReportRemote Code ExecutionSupply ChainExploitGenerated Malware Used

Authoritative Intelligence

CVE CVE-2025-55182 Incident identifier

EPSS is a vulnerability exploitation probability signal, not proof that your environment is exposed. CISA KEV means known exploitation of the vulnerability, not that your system was exploited.

Public GitHub References

Search GitHub for public repositories that mention this CVE. BugSkan only lists repository metadata as a defensive awareness signal — it does not fetch or display exploit code.

CVE-2025-55182 on GitHub

Timeline

  • Incident first seen
    Feb 10, 2026 05:30

    BugSkan first recorded this incident.

  • AI/LLM-Generated Malware Used to Exploit React2Shell - Darktrace
    Feb 10, 2026 05:30

    darktrace.com · Malware

  • AI shrinks vulnerability exploitation window to hours - Help Net Security
    May 18, 2026 12:30

    news.google.com · Vulnerability

  • Latest observed development
    May 18, 2026 12:30

    Most recent source or update associated with this incident.

Sources

AI/LLM-Generated Malware Used to Exploit React2Shell - Darktrace

darktrace.com · Feb 10, 2026 05:30

An AI-generated malware sample exploited CVE-2025-55182, known as React2Shell, within a Docker honeypot with an exposed daemon. This resulted in remote code execution, allowing the deployment of an XMRig cryptominer on over ninety compromised hosts and demonstrating the operational value of LLMs for low-skill adversaries.

Open publisher source
AI shrinks vulnerability exploitation window to hours - Help Net Security

news.google.com · May 18, 2026 12:30

AI shrinks vulnerability exploitation window to hours Help Net Security

Open publisher source

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match

Want personalized relevance?

Create an account to see which incidents overlap with your interests.

← Back to incident intelligence