🕳️ Vulnerabilities & CVEs

UAT-10608's Automated Credential Grab: Next.js Apps Bleeding Secrets via React2Shell

Credentials pouring out. An automated campaign's hitting vulnerable Next.js setups, siphoning secrets faster than you can say 'patch management.' UAT-10608 doesn't mess around.

Threat Digest Apr 07, 2026 3 min read
Diagram of UAT-10608 automated attack chain exploiting React2Shell in Next.js application

⚡ Key Takeaways

  • UAT-10608 automates credential theft from vulnerable Next.js apps via React2Shell, exploiting SSRF-to-RCE paths. 𝕏
  • Over 15k exposures detected recently; unpatched 13.x versions hit hardest. 𝕏
  • Patch to 14.2.3+, scan with Nuclei, rotate secrets—echoes Log4Shell risks for JS stacks. 𝕏
Published by

Threat Digest

Threat intelligence. Zero noise.

#Next.js vulnerability #React2Shell #React2Shell flaw #UAT-10608 #credential harvesting

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Dark Reading

Related Stories

📬

Stay in the loop

The week's most important stories from Threat Digest, delivered once a week.

No spam. Unsubscribe any time.