Active React2Shell exploitation uses malicious NGINX configurations to hijack web traffic, targeting Baota panels, Asian TLDs ...
Two IP addresses accounted for the majority of the 1.4 million exploitation attempts observed over the past week.