_This is a submission for the MLH x DEV Writing Challenge_ Every security researcher has a "Project Graveyard" - a dusty local directory where dormant Proof of Concepts (PoCs), 2 AM exploit scripts, and ephemeral bypasses go to die. For me, that script was a raw, 50-line Python snippet authored in December 2025. A CVSS 10.0 vulnerability (CVE-2025-55182 / React2Shell) had just dropped, exposing a critical unauthenticated Remote Code Execution (RCE) attack vector via unsafe deserialization of the React Flight protocol. My script successfully fingerprinted the vulnerability, but its architecture was archaic: synchronous, entirely ephemeral, and reliant on manual DevTools injection to scan a target DOM. It was a functional PoC, but terrible for actual field reconnaissance. When the **MLH Finish-Up-a-Thon** launched, I decided to pull this script out of the archive and operationalize it. Armed with **GitHub Copilot** as my autonomous platform engineer, I spent 48 hours transforming a brittle terminal script into a highly resilient, event-driven, Manifest V3 Chrome Extension. Here is how we turned digital duct tape into a production-grade vulnerability reconnaissance asset. ## What I Built: The RSC Reconnaissance Engine I engineered the **RSC Fingerprint Detector** , a Manifest V3 (MV3) Chrome extension designed for passive and active telemetry gathering on React Server Components (RSC) and the React2Shell deserialization vulnerability class. To eliminate false positives during target enumeration, the extension deploys a strict, dual-phase heuristic pipeline: * **Passive Reconnaissance (Zero-Touch):** Silently hooks the global execution context (`window.__next_f`), performs script asset introspection (`react-server-dom-webpack`), utilizes DOM attribute scanning (`data-rsc`), and monitors network traffic for specific HTTP response headers (`Vary: RSC`). * **Active Probing:** Fires a cross-origin, asynchronous `fetch` with a crafted `X-RSC-Probe` header payload. It then parses the resulting content-type entropy to extract the exact React Flight protocol signature without triggering target backend alerts. **The Architecture Upgrade:** We migrated from a synchronous, single-vector Python script that lost its execution context on page reload, to a declarative MV3 architecture. The new engine features IndexedDB ACID transactions for persistent telemetry, cross-context Inter-Process Communication (IPC), and DOM isolation via Shadow DOM to prevent CSS cross-contamination. ## Telemetry & Visual Proof **GitHub Repository:** anuththara2007-W/CVE-2025-55182-Exploit-extension There is nothing quite as satisfying as the visual proof of operationalizing a raw exploit script into a deployable tool. December 2025 (The Ephemeral PoC) | May 2026 (The Operationalized Asset) ---|--- | _Raw console execution. Highly manual. Zero state persistence._ | _Isolated UI, real-time threat badges, and active CVE mapping._ ## Partner Technologies: GitHub Copilot as a Cyber-Operations Ally Writing the core heuristic logic for vulnerability detection is the fun part. Wrestling with Chrome’s restrictive Content Security Policies (CSP), isolated execution worlds, and MV3 lifecycle deprecations is the grueling friction that kills side projects. **Without GitHub Copilot, this asset would still be a dormant script.** I didn't just use it for autocomplete; I utilized it as a senior platform architect who understood the Chrome Sandbox limitations intimately. Here is how Copilot acted as an elite force multiplier: **1. Bypassing the Manifest V3 Sandbox Constraints** Background pages are dead in MV3. Copilot flawlessly orchestrated my `manifest.json` schema, registering the Service Worker and migrating my network interception logic to `declarativeNetRequest` instead of the blocking `webRequest` API. It completely bypassed the dreaded "persistent flag" runtime errors that plague MV3 migrations. **2. Bridging the Asynchronous IPC Gap** When setting up `chrome.runtime.sendMessage` across isolated execution contexts (content script to background worker), Copilot automatically injected the mandatory `return true` directive inside the `onMessage` listener. > _The Technical Impact:_ In MV3, failing to return `true` immediately terminates the IPC message channel, causing silent failures for asynchronous callbacks. Copilot patched this race condition before the code even compiled. **3. Architecting Persistent Telemetry** I needed persistent local storage for scan logs but wanted to avoid bloated wrapper libraries. Copilot generated a raw IndexedDB implementation from scratch, engineering the `onupgradeneeded` handler, object store schemas, and timestamp indexing. It proactively wrapped the database transactions in `try/catch` blocks, implementing idempotency and retry logic for transient database lock errors. ### The "Mic-Drop" Network Interception The most impressive moment occurred while configuring the passive packet-sniffing logic. I wrote a single comment: `// Capture RSC responses via webRequest` Copilot instantly synthesized this interception block: chrome.webRequest.onHeadersReceived.addListener( function(details) { const isRSC = details.responseHeaders.some(h => h.name.toLowerCase() === 'content-type' && h.value.includes('text/x-component') ); if (isRSC) { saveFlight(details); // Trigger telemetry extraction } }, { urls: ["<all_urls>"] }, ["responseHeaders"] // <-- Copilot successfully identified this mandatory MV3 bypass! ); Injecting `"responseHeaders"` into the `extraInfoSpec` array is an obscure, critical MV3 security requirement. If omitted, Chrome silently sanitizes the headers from your extension's execution context. Copilot's deep contextual awareness of Chrome's security model saved me hours of debugging silent telemetry drops. ## Hackathon Experience Participating as a Solo Developer in the MLH Finish-Up-a-Thon completely shifted my perspective on software development in the security space. Standard hackathons prioritize reckless velocity-getting a prototype to compile by any means necessary. This event prioritized _craftsmanship and operational readiness_. It forced me to analyze the "last mile" of software engineering: error boundaries, state persistence, UI reactivity, and adhering to strict platform security models. We often abandon security research tools because the friction of engineering a deployable interface outweighs the adrenaline of writing the initial exploit logic. GitHub Copilot eradicated that friction. It handled the exhausting platform boilerplate, allowing me to focus 100% of my cognitive load on the vulnerability architecture. My biggest takeaway? A dead PoC doesn't have to stay in the graveyard. With the right AI tooling and a structured deadline, you can resurrect a forgotten script and weaponize it into a professional-grade asset. _Disclaimer: This reconnaissance tool is intended strictly for authorized vulnerability scanning, threat intelligence, and educational purposes. Use only on infrastructure you own or have explicit, documented authorization to test._

Datadog Security Research identified two unauthenticated credential-harvesting platforms, Loot and UltraVault, that inventory, validate, and operationalize stolen secrets, including AWS and AI service credentials. The activity shows AI-assisted attack workflows, active re-probing of credentials, and exploitation chains tied to vulnerabilities such as react2shell, wp2shell, xss2shell, and joomla2shell. #Datadog #Loot #UltraVault #AmazonBedrock #Anthropic #OpenAI #AWS #CVE-2025-55182 #CVE-2026-63030 #CVE-2026-60137 #CVE-2026-64638 #CVE-2026-48907

The UAT-10608 campaign exploits the React2Shell RCE flaw to harvest sensitive credentials from Next.js apps, compromising 766 hosts globally.

A technical analysis of CVE-2025-55182, demonstrating how React Server Components deserialization leads to remote code execution.

Stateful detections are emerging as a critical control for cloud-native runtime security because attacks such as React2Shell and AI-assisted intrusions can escalate from vulnerability disclosure to compromise in minutes. The article also highlights the rise of JADEPUFFER, widespread adoption of stateful detections, and the growing need for trusted automated response to keep pace with agentic threat actors. #React2Shell #JADEPUFFER #Sysdig

クラウドネイティブ環境を守るには、迅速な対応が不可欠です。クラウドセキュリティが人間のスケールの限界に達しつつあることについては、私たちはこれまでも繰り返し指摘してきました。2026年初頭には、明らかな変化が起きました。React2Shellのような攻撃が、脆弱性の公開からわずか数時間後に発生するようになったのです。し

Darktrace says the first half of 2026 was defined by attackers abusing trusted identities, SaaS, cloud entitlements, AI systems, and supply-chain relationships rather than relying on traditional exploitation, with one React2Shell honeypot compromised in under two hours. Campaigns involving StealC, AMOS, Phexia, Axios, Trivy, Hola VPN, BeyondTrust, and JadePuffer showed how quickly trust-based tradecraft, AI-generated malware, and supply-chain abuse are reshaping intrusion paths. #React2Shell #Darktrace #StealC #AMOS #Phexia #Axios #Trivy #HolaVPN #BeyondTrust #JadePuffer

YouTube video by Security Weekly - A CRA Resource

Chinese actors exploited the critical React2Shell exploit inside a day, while 88% of exploited vulnerabilities in H1 2026 were compromised within 48 hours of disclosure

Talos found that threat actors are rapidly abusing AI for malicious development, operational scaling, and vulnerability research, while weak guardrails are often bypassed with simple claims of ownership, bug bounty labeling, or task decomposition. The report shows AI being used to build DDoS tooling, bulk-mail validation systems, credential-harvesting pipelines, mining operations,...

A critical React RCE, a new npm supply-chain worm, and Cursor's new Workspace access all landed this week. Here's what it means for apps built with AI coding tools.

How CVE-2025-55182 (React2Shell) cryptojacked a forgotten Raspberry Pi running an unpatched Next.

A technical analysis of CVE-2025-55182, demonstrating how React Server Components deserialization leads to remote code execution.

Three new Pydantic AI CVEs hit agent frameworks on Vercel, Lovable auto-revokes leaked keys, and Next.js exploit attempts keep climbing post-React2Shell.