Author: admin

MIO: Memories in Orbit: MIO: Memories In Orbit Sets Course for January 20, 2026

New trailer revealed the release date for the upcoming indie metroidvania with captivating new images during the PC Gaming Show.

Following the reveal of the game’s demo, today Focus Entertainment and Douze Dixiemes are excited…

Continue Reading

December 4, 2025

Critical Vulnerabilities in React Server Components and Next.js

Executive Summary

On Dec. 3, 2025, researchers publicly disclosed critical remote code execution (RCE) vulnerabilities in the Flight protocol used by React Server Components (RSC). These vulnerabilities are tracked as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js), which have been assigned a maximum severity rating of CVSS 10.0.

The flaw allows unauthenticated attackers to execute arbitrary code on the server via insecure deserialization of malicious HTTP requests. Testing indicates the exploit has near-100% reliability and requires no code changes to be effective against default configurations. There have been no reports of exploitation in the wild as of Dec. 3, 2025.

React is heavily implemented in enterprise environments, used by roughly 40% of all developers, while Next.js is used by approximately 18%-20%. This makes it the leading server-side framework for the React ecosystem.

Palo Alto Networks Cortex Xpanse has identified the presence of over 968,000 React and Next.js instances in our telemetry.

These vulnerabilities impact the React 19 ecosystem and frameworks that implement it. Specifically, they affect the following versions:

React: Versions 19.0, 19.1, and 19.2
Next.js: Versions 15.x and 16.x (App Router), as well as Canary builds starting from 14.3.0
Other frameworks: Any library bundling the react-server implementation, including React Router, Waku, RedwoodSDK, Parcel and Vite RSC plugins

Palo Alto Networks customers receive protections from and mitigations for CVE-2025-55182 and CVE-2025-66478 in the following ways:

Cortex XDR and XSIAM agents help protect against post-exploitation activities using the multi-layer protection approach.

Palo Alto Networks also recommends upgrading to the following hardened versions immediately:

React: Upgrade to 19.0.1, 19.1.2, or 19.2.1
Next.js: Upgrade to the latest stable patched versions, including 16.0.7, 15.5.7, 15.4.8, 15.3.6, 15.2.6, 15.1.9 or 15.0.5

The Unit 42 Incident Response team can be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

Details of the Vulnerabilities: CVE-2025-55182 (React) and CVE-2025-66478 (Next.js)

CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) are classified as Critical (CVSS 10.0) and are caused by insecure deserialization within the RSC architecture, specifically involving the Flight protocol.

The vulnerabilities reside in the react-server package and its implementation of the RSC Flight protocol. It is a logical deserialization flaw where the server processes RSC payloads safely.

When a server receives a specially crafted, malformed HTTP payload (typically through data delivered in a POST request), it fails to correctly validate the structure of the data. Because of this insecure deserialization, the server allows attacker-controlled data to influence server-side execution logic.

This results in RCE, allowing an attacker to execute arbitrary privileged JavaScript code on the server.

Attack Vector and Exploitability

Attack complexity: The attack complexity is low. It requires no user interaction and no privileges (unauthenticated).
Target endpoints: The attack targets React Server Function endpoints.
- Critical nuance: Even if an application does not strictly implement or use React Server Functions, it remains vulnerable if the application supports React Server Components generally.
Reliability: Testing has shown the exploit has near-100% reliability.
Default configuration: The vulnerabilities are present in default configurations. For example, a standard Next.js application created with create-next-app and built for production is exploitable without any code changes by the developer.

Specific Affected Components

While generally described as affecting React and Next.js, the vulnerabilities technically exist within specific underlying packages that handle server-side rendering and module loading.

Affected Packages

The vulnerabilities are present in versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0 of the following packages:

react-server-dom-webpack
react-server-dom-parcel
react-server-dom-turbopack

Affected Framework Implementations

Any framework bundling these packages is affected:

Next.js: Versions 15.x and 16.x (App Router), as well as Canary builds starting from 14.3.0-canary.77
Other ecosystems: React Router, Waku, RedwoodSDK, Parcel and the Vite RSC plugin are all affected if they use the vulnerable React packages

Interim Guidance

Required actions: Immediate patching is the only definitive mitigation.

Engineering and security teams should upgrade to the following hardened versions immediately:

React: Upgrade to 19.0.1, 19.1.2, or 19.2.1
Next.js: Upgrade to the latest stable patched versions, including 16.0.7, 15.5.7, 15.4.8, 15.3.6, 15.2.6, 15.1.9 or 15.0.5

For the latest updates on these vulnerabilities, please see the documentation provided by each respective vendor:

Unit 42 Managed Threat Hunting Queries

The Unit 42 Managed Threat Hunting team continues to track any attempts to exploit this CVE across our customers, using Cortex XDR and the XQL queries below. Cortex XDR customers can also use these XQL queries to search for signs of exploitation.

The following hunting queries are not high-fidelity detections and should be investigated to determine whether the web server operates vulnerable React Server Components.

// Description: File operations targeting potentially sensitive files or indications of exploitation of CVE-2025-55182 // Caveat 1: Next.js may still be running if a custom server.js is in use, as such the filtering of ‘actor_process_command_line contains “.next”‘ restricts the results to ‘standard’ Next.js deployment and if not overly noisy we recommend running the query without it too. // Caveat 2: Vulnerable React Server Component (RSC) endpoints may be served by a wider range of JavaScript runtimes than just NodeJS (such as Bun or Deno) and we recommend re-executing the queries targeting these runtimes if they are used in your environment. config case_sensitive = false | preset=xdr_file | filter actor_process_image_name in (“node”,”node.exe”) and actor_process_command_line contains “.next” and action_file_path ~= “(?:pwned.txt|.ssh[\/]authorized_keys|.aws[\/]credentials|gcloud[\/]credentials.db|.azure[\/]accessTokens.json|2025[-_](?:55182|66478))”

// Description: File operations targeting potentially sensitive files or indications of exploitation of CVE-2025-55182

// Caveat 1: Next.js may still be running if a custom server.js is in use, as such the filtering of ‘actor_process_command_line contains “.next”‘ restricts the results to ‘standard’ Next.js deployment and if not overly noisy we recommend running the query without it too.

// Caveat 2: Vulnerable React Server Component (RSC) endpoints may be served by a wider range of JavaScript runtimes than just NodeJS (such as Bun or Deno) and we recommend re-executing the queries targeting these runtimes if they are used in your environment.

config case_sensitive = false

| preset=xdr_file

// Description: Identifies a Node.js process directly spawning common system reconnaissance tools to gather user, network, or process information. // Caveat: May be prone to false positives. Investigate hits within the context of a NodeJS server running a version of React with vulnerable React Server Components config case_sensitive = false | preset=xdr_process | filter actor_process_image_name in (“node”,”node.exe”) and actor_process_command_line contains “.next” and action_process_image_name in (“id”,”curl”,”curl.exe”,”wget”,”wget.exe”,”whoami”,”arp.exe”,”at.exe”,”hostname.exe”,”nbstat.exe”,”netsh.exe”,”netstat.exe”,”nslookup.exe”,”ping.exe”,”query.exe”,”systeminfo.exe”,”tasklist.exe”,”traceroute.exe”,”whoami.exe”,”whois.exe”,”quser.exe”,”qwinsta.exe”,”nltest.exe”,”csvde.exe”,”wevtutil.exe”,”driverquery.exe”,”nbtscan.exe”,”ntdsutil.exe”,”vssadmin.exe”,”dsquery.exe”,”adfind.exe”,”klist.exe”,”vssvc.exe”) | comp count_distinct(action_process_image_name) as num_procs, values(action_process_image_command_line) as action_process_image_command_line by agent_hostname, actor_process_image_name, actor_process_command_line, action_process_image_name | filter num_procs > 1

// Description: Identifies a Node.js process directly spawning common system reconnaissance tools to gather user, network, or process information.

// Caveat: May be prone to false positives. Investigate hits within the context of a NodeJS server running a version of React with vulnerable React Server Components

config case_sensitive = false

| preset=xdr_process

| filter actor_process_image_name in (“node”,“node.exe”) and actor_process_command_line contains “.next” and action_process_image_name in (“id”,“curl”,“curl.exe”,“wget”,“wget.exe”,“whoami”,“arp.exe”,“at.exe”,“hostname.exe”,“nbstat.exe”,“netsh.exe”,“netstat.exe”,“nslookup.exe”,“ping.exe”,“query.exe”,“systeminfo.exe”,“tasklist.exe”,“traceroute.exe”,“whoami.exe”,“whois.exe”,“quser.exe”,“qwinsta.exe”,“nltest.exe”,“csvde.exe”,“wevtutil.exe”,“driverquery.exe”,“nbtscan.exe”,“ntdsutil.exe”,“vssadmin.exe”,“dsquery.exe”,“adfind.exe”,“klist.exe”,“vssvc.exe”)

| comp count_distinct(action_process_image_name) as num_procs, values(action_process_image_command_line) as action_process_image_command_line by agent_hostname, actor_process_image_name, actor_process_command_line, action_process_image_name

| filter num_procs > 1

// Description: Identifies a specific causality chain where Node.js spawns a shell (cmd/bash/powershell), which subsequently spawns a downloader (curl/wget). config case_sensitive = false | preset=xdr_process | filter causality_actor_process_image_name in (“node”,”node.exe”) and causality_actor_process_command_line contains “.next” and actor_process_image_name in (“cmd.exe”,”powershell.exe”,”sh”,”bash”,”zsh”) and action_process_image_name in (“curl”,”curl.exe”,”wget”,”wget.exe”)

// Description: Identifies a specific causality chain where Node.js spawns a shell (cmd/bash/powershell), which subsequently spawns a downloader (curl/wget).

config case_sensitive = false

| preset=xdr_process

| filter causality_actor_process_image_name in (“node”,“node.exe”) and causality_actor_process_command_line contains “.next” and actor_process_image_name in (“cmd.exe”,“powershell.exe”,“sh”,“bash”,“zsh”) and action_process_image_name in (“curl”,“curl.exe”,“wget”,“wget.exe”)

Conclusion

The critical distinction of these vulnerabilities is their nature as a deterministic logic flaw in the Flight protocol, rather than a probabilistic error. Unlike memory corruption bugs that may fail, this flaw guarantees execution, transforming it into a reliable system-wide bypass for attackers. Amplified by the massive footprint of Next.js in enterprise environments, this creates a direct conduit to sensitive internal data.

Ultimately, this incident underscores the inherent friction between performance and security in modern architecture. While React Server Components optimize data fetching and search engine optimization (SEO) by moving logic closer to the source, they simultaneously move the attack surface closer to organizations’ most sensitive and valuable data.

Palo Alto Networks customers are better protected by our products, as listed below. We will update this threat brief as more relevant information becomes available.

Palo Alto Networks Product Protections for CVE-2025-55182 and CVE-2025-66478

Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat.

If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
UK: +44.20.3743.3660
Europe and Middle East: +31.20.299.3130
Asia: +65.6983.8730
Japan: +81.50.1790.0200
Australia: +61.2.4062.7950
India: 000 800 050 45107

Cortex XDR and XSIAM

Cortex XDR and XSIAM agents help protect against post-exploitation activities using the multi-layer protection approach.

Continue Reading

December 4, 2025

Pakistan to keep Afghan border closed without terror assurances: FO

ISLAMABAD (Dunya News) – Pakistan has once again reiterated its clear stance that the border will remain closed until the Afghan government provides firm assurances to prevent terrorist infiltration into…

Continue Reading

December 4, 2025
AI & Artificial Intelligence | Stark Insider

From our AI lab to daily workflows with Claude, ChatGPT, and Gemini—we don’t just write about AI, we work alongside it.

Since 2024, Stark Insider has documented the human-AI collaboration frontier. Our team includes 6 AI assistants…

Continue Reading

December 4, 2025
Pneumonia Complications and Corticosteroid Use

A systematic review and meta-analysis evaluated the association between corticosteroid therapy, mortality, and infectious complications in adults with severe non-COVID-19 pneumonia or acute respiratory distress syndrome (ARDS). The…

Continue Reading

December 4, 2025
Was Harry referencing Trump in joke for Late Show sketch?

The Duke of Sussex appeared to joke about US President Donald Trump in an appearance on The Late Show With Stephen Colbert.

Prince Harry appeared in a US TV sketch with Colbert, where he auditioned as himself for a “Christmas prince” role in a…

Continue Reading

December 4, 2025
Pantone Color of the Year 2026 gives neutral (again)

As 2025’s cultural retrospectives begin to trickle in (read: Spotify Wrapped or Oxford’s word of the year), Pantone is not to be outdone.

The famed color factory on Thursday, Dec. 4, released its shade of the upcoming year, or perhaps more…

Continue Reading

December 4, 2025
Jon M. Chu Says AI Couldn’t Have Made One of Wicked’s Best Moments

If there’s anyone who understands the importance of viral marketing, it’s Wicked: For Good director Jon M. Chu.

At WIRED’s Big Interview event in San Francisco, the onetime YouTuber and Crazy Rich Asians director said that working with acts…

Continue Reading

December 4, 2025
Assessing UiPath’s Valuation After Recent AI Automation Expansion and Choppy Share Price Moves
If you have been wondering whether UiPath is a hidden bargain or a value trap at around $14.86 a share, you are not alone. This article is going to walk through exactly what the numbers are really saying.

Despite being down about 6.4% over the last month and roughly 3.1% over the past year, the stock is still up 9.3% over the last week and 14.9% year to date, which signals that sentiment around its long term potential is far from settled.

Recent headlines have focused on UiPath expanding its AI powered automation offerings and strengthening key partnerships, underlining its push to stay at the center of the automation trend. At the same time, market commentary has highlighted both rising competition and shifting expectations for high growth software names, helping explain the stock’s choppy price action.

On our framework, UiPath scores a 3/6 valuation check. This suggests it looks undervalued on some metrics but not convincingly cheap across the board. Next we will unpack the main valuation approaches investors are using and then finish with a more holistic way to make sense of what UiPath might really be worth.

Find out why UiPath’s -3.1% return over the last year is lagging behind its peers.

A Discounted Cash Flow model projects a company’s future cash flows and then discounts them back to today’s dollars to estimate what the business is worth right now.

For UiPath, the latest twelve month Free Cash Flow is about $318.9 million. Analysts and internal estimates see this rising steadily, with projected Free Cash Flow reaching roughly $695.4 million by 2035, based on a 2 Stage Free Cash Flow to Equity framework. Simply Wall St uses explicit analyst forecasts for the next few years and then extrapolates further out to build a 10 year cash flow curve.

When these future cash flows are discounted back to today, the model arrives at an intrinsic value of about $18.10 per share. Compared with the current share price around $14.86, the DCF suggests UiPath is trading at roughly a 17.9% discount to its estimated fair value. On this basis, the shares appear attractively priced according to the model.

Result: UNDERVALUED

Our Discounted Cash Flow (DCF) analysis suggests UiPath is undervalued by 17.9%. Track this in your watchlist or portfolio, or discover 908 more undervalued stocks based on cash flows.

PATH Discounted Cash Flow as at Dec 2025

Head to the Valuation section of our Company Report for more details on how we arrive at this Fair Value for UiPath.

For a growing software business like UiPath that is still prioritizing scale over bottom line profits, the Price to Sales ratio is often a more reliable yardstick than earnings based metrics. Revenue tends to be more stable and less affected by short term swings in investment spending, making it a cleaner way to compare valuation.
What investors are really paying for in a sales multiple is future growth and the risk that growth disappoints. Faster, more predictable growers can usually justify a higher multiple, while slower or riskier names tend to trade closer to, or below, the industry norm.

UiPath currently trades on about 5.27x sales, slightly above the Software industry average of roughly 4.91x but well below the peer group average of around 9.46x. Simply Wall St’s Fair Ratio for UiPath, at about 6.46x, is a proprietary estimate of what the sales multiple should be given its growth profile, margins, industry, market cap and risk. Because it is tailored to UiPath’s specific fundamentals rather than broad group averages, it offers a more nuanced benchmark than simple peer or sector comparisons. On this basis, the current 5.27x sales looks below the Fair Ratio, which may indicate undervaluation.

Result: UNDERVALUED

NYSE:PATH PS Ratio as at Dec 2025

PS ratios tell one story, but what if the real opportunity lies elsewhere? Discover 1442 companies where insiders are betting big on explosive growth.

Earlier we mentioned that there is an even better way to understand valuation, so let us introduce you to Narratives, a simple way to attach your own story about UiPath to the numbers by linking what you believe about its products, partnerships, growth and risks to a concrete forecast for future revenue, earnings, margins and ultimately a Fair Value estimate. You can then compare this directly to today’s share price to decide whether it looks like a buy, a hold or a sell. On Simply Wall St’s Community page, millions of investors use Narratives as an easy, accessible tool that turns their view of a company into a living valuation that automatically refreshes when new information such as earnings, guidance or major news is released. This helps their Fair Value stay in sync with reality instead of going stale. For UiPath, one Narrative might lean into its AI partnerships and cloud momentum to justify a higher Fair Value closer to the most bullish target around $17. A more cautious Narrative could focus on competition, FX and SaaS transition risks to anchor Fair Value nearer the most bearish view around $11.71, showing how different stories can lead to very different but clearly framed decisions.

Do you think there’s more to the story for UiPath? Head over to our Community to see what others are saying!

NYSE:PATH Community Fair Values as at Dec 2025

This article by Simply Wall St is general in nature. We provide commentary based on historical data and analyst forecasts only using an unbiased methodology and our articles are not intended to be financial advice. It does not constitute a recommendation to buy or sell any stock, and does not take account of your objectives, or your financial situation. We aim to bring you long-term focused analysis driven by fundamental data. Note that our analysis may not factor in the latest price-sensitive company announcements or qualitative material. Simply Wall St has no position in any stocks mentioned.

Companies discussed in this article include PATH.

Have feedback on this article? Concerned about the content? Get in touch with us directly. Alternatively, email editorial-team@simplywallst.com
Continue Reading
December 4, 2025
Pneumonia-related Bacterial Enzyme Causes Heart Conditions
A pneumococcal enzyme, zmpB, is a key factor in some pneumonia patients develop serious heart complications.

RT’s Three Key Takeaways:
1. Bacterial Driver of Cardiac Complications – Researchers identified a pneumococcal…
Continue Reading
December 4, 2025