News brief: RCE flaws persist as top cybersecurity threat

<p>Remote code execution flaws are among the most prevalent and critical vulnerabilities in software today. Some of the most high-profile cybersecurity events in history — including the 2021 Log4Shell Log4j library vulnerability, the Apache Struts vulnerability that led to the 2017 Equifax breach and the 2014 Shellshock Bash vulnerability — were attributed to <a href=”https://www.techtarget.com/searchwindowsserver/definition/remote-code-execution-RCE”>RCE</a> flaws.</p>
<p>RCE exploits aren’t new — in fact, they have existed for decades. The result of coding errors, configuration issues or insecure input handling, these popular targets enable attackers to execute malicious code on a target system. As of Dec. 4, more than 20% of the entries in CISA’s Known Exploited Vulnerabilities catalog are related to RCEs.</p>
<p>This week’s featured news looks at a few of the latest RCEs and their impact.</p>
<section class=”section main-article-chapter” data-menu-title=”Critical React vulnerability enables RCE in cloud environments”>
<h2 class=”section-title”><i class=”icon” data-icon=”1″></i>Critical React vulnerability enables RCE in cloud environments</h2>
<p>A maximum-severity vulnerability in React, a popular open source JavaScript library that was developed at Facebook (now Meta) and released as open source in 2013, has raised alarms due to its potential to enable RCE in numerous cloud environments.</p>
<p>Two CVEs — CVE-2025-55182 and CVE-2025-66478 — highlight unsafe deserialization in React Server Components and its downstream effect on the Next.js framework.</p>
<p>Both vulnerabilities received a CVSS score of 10, enabling attackers to exploit servers with crafted HTTP requests. Meta and React teams released fixes and urged organizations to update React and Next.js versions immediately. Cloud connectivity vendor Cloudflare implemented proactive web application firewall rules to block exploitation, while cloud security platform vendor Wiz reported that 39% of cloud environments remain vulnerable, emphasizing the urgency of mitigation.</p>
<p><a target=”_blank” href=”https://www.darkreading.com/vulnerabilities-threats/critical-react-flaw-triggers-immediate-action” rel=”noopener”><i>Read the full story by Rob Wright on Dark Reading</i></a><i>.</i></p>
</section>
<section c

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.