Vulnerabilities & Exploits · Cryptojacking

Attackers shift to RCE bugs to compromise clouds

Google found bug exploits caused 44.5% of investigated intrusions versus 27% for credential theft.

4 sources · Mar 13

CVE-2025-24893

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: xWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. EPSS 100% (100th percentile).

CISA federal remediation date Nov 20 · date passed

CVE-2025-55182

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: a pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0… Known ransomware campaign use. EPSS 100% (100th percentile).

CISA federal remediation date Dec 12 · date passed

Timeline

Mar 13 Reported by Dark Reading
Mar 11 Reported by Help Net Security
Mar 10 Reported by Infosecurity Magazine
Mar 9 Reported by BleepingComputer
Dec 12 CISA federal deadline for CVE-2025-55182 passed
Dec 5 CVE-2025-55182 added to CISA KEV
Nov 20 CISA federal deadline for CVE-2025-24893 passed
Oct 30 CVE-2025-24893 added to CISA KEV

Sources

Mar 13 Dark Reading
Most Google Cloud Attacks Start With Bug Exploitation
Thanks to AI, the new top cause of cloud compromises is vulnerability exploits that beat patching cycles.
original
Mar 11 Help Net Security
Software vulnerabilities push credential abuse aside in cloud intrusions - Help Net Security
Cyber threats in cloud environments are shifting toward software vulnerabilities, identity compromise and insider data theft.
original
Mar 10 Infosecurity Magazine
Cloud Attackers Now Prefer Vulnerability Exploits Over Credentials
Google Cloud report details a sharp rise in attackers exploiting software vulnerabilities, including React2Shell
original

Part of the PlainSec briefing for 2026-03-23

Every edition of this story: Attackers shift to RCE bugs to compromise clouds

More from today

Vulnerabilities & Exploits · CryptojackingAttackers shift to RCE bugs to compromise cloudsGoogle found bug exploits caused 44.5% of investigated intrusions versus 27% for credential theft.4 sources · Mar 13

CVE-2025-24893

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: xWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. EPSS 100% (100th percentile).

CISA federal remediation date Nov 20 · date passed

CVE-2025-55182

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: a pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0… Known ransomware campaign use. EPSS 100% (100th percentile).

CISA federal remediation date Dec 12 · date passed

Timeline

Mar 13 Reported by Dark Reading

Mar 11 Reported by Help Net Security

Mar 10 Reported by Infosecurity Magazine

Mar 9 Reported by BleepingComputer

Dec 12 CISA federal deadline for CVE-2025-55182 passed

Dec 5 CVE-2025-55182 added to CISA KEV

Nov 20 CISA federal deadline for CVE-2025-24893 passed

Oct 30 CVE-2025-24893 added to CISA KEV

Sources

Mar 13 Dark Reading

Most Google Cloud Attacks Start With Bug Exploitation

Thanks to AI, the new top cause of cloud compromises is vulnerability exploits that beat patching cycles.

original

Mar 11 Help Net Security

Software vulnerabilities push credential abuse aside in cloud intrusions - Help Net Security

Cyber threats in cloud environments are shifting toward software vulnerabilities, identity compromise and insider data theft.

original

Mar 10 Infosecurity Magazine

Cloud Attackers Now Prefer Vulnerability Exploits Over Credentials

Google Cloud report details a sharp rise in attackers exploiting software vulnerabilities, including React2Shell

original

Part of the PlainSec briefing for 2026-03-23Every edition of this story: Attackers shift to RCE bugs to compromise cloudsMore from today

Interlock ransomware uses zero-day to compromise firewalls

Critical SharePoint flaw being actively exploited

CISA orders federal agencies to patch n8n RCE