December 2025, the RondoDox botnet operators have been targeting Next.js servers impacted by the React2Shell vulnerability.
GreyNoise says a recently observed Adobe ColdFusion exploitation campaign is linked to a massive initial access broker operation.