Executive Summary This week has seen a critical escalation in the Australian cyber threat landscape, dominated by a maximum-severity vulnerability in a widely used web framework and significant breaches in the Defence and Education sectors. The Australian Cyber Security Centre (ACSC) has issued urgent alerts, and organisations across all sectors—particularly those using React-based web applications—must take immediate action.

Here is your deep dive into the threats, incidents, and vulnerabilities shaping the last 7 days (01–07 December 2025).

Vulnerability Spotlight: "React2Shell" (CVE-2025-55182)

Severity: Critical (CVSS 10.0) Affected Sectors: All (SaaS, eCommerce, FinTech, Healthcare)

The most pressing threat this week is CVE-2025-55182, dubbed "React2Shell". This is a critical Remote Code Execution (RCE) vulnerability affecting React Server Components (versions 19.0.0 to 19.2.0).

The Threat: Unauthenticated attackers can send specially crafted HTTP requests to vulnerable servers to execute arbitrary code.
Active Exploitation: The ACSC and AWS security teams have confirmed that China-nexus threat actors (tracked as Earth Lamia and Jackpot Panda) are actively exploiting this flaw to compromise web servers.
Action: Patch immediately to React version 19.0.1+ or apply WAF mitigations. If you use Next.js or similar frameworks, ensure you are on the latest secure release.

Sector-Specific Threat Intelligence

Government & Defence

Target: IKAD Engineering
Incident: A major supply chain breach has hit IKAD Engineering, a key contractor for Australia’s defence sector. The J Group (linked to RansomHub) has claimed responsibility, allegedly exfiltrating 800GB of sensitive data.
Impact: The stolen data reportedly includes schematics and documents related to the Hunter Class frigate and Collins Class submarine programs. This highlights the critical risk posed by third-party suppliers in the defence industrial base.

Education / EdTech

Target: Western Sydney University (WSU)
Incident: In a significant development regarding insider threats, NSW Police charged a 27-year-old former student on 05 December 2025. Despite being on bail for previous offences, the individual allegedly continued to hack university systems, modifying a mobile phone to act as a terminal and sending over 100,000 fraudulent emails to students.
Takeaway: This case underscores the persistence of insider threats and the necessity for robust identity management and behavioural monitoring within educational networks.

FinTech

Target: Austin’s Financial Solutions
Incident: The Kairos ransomware gang has listed the NSW-based wealth management firm as a victim. The group claims to have stolen 147GB of data, including employee passports, payroll records, and client contracts.
Target: Vroom by YouX
Incident: A cloud security lapse left a database non-password protected, exposing thousands of driver's licences and personal financial documents. This serves as a stark reminder to audit API endpoints and cloud storage permissions.

eCommerce

Regional Warning: While primarily affecting South Korea, the massive Coupang breach confirmed on 02 December (33.7 million customers) is sending shockwaves through the region. The breach was traced to a former employee's active credentials, reinforcing the need for strict offboarding processes and "least privilege" access controls in Australian eCommerce platforms.

IoT & Critical Infrastructure

Strategic Shift: On 03 December 2025, the ACSC, in collaboration with CISA, released the Principles for the Secure Integration of Artificial Intelligence in Operational Technology (OT).
Relevance: As Healthcare and Energy sectors increasingly integrate AI into physical control systems (IoT), this guide provides the new baseline for securing these converged environments against manipulation and sabotage.

Recommendation for the Week

Audit for React: Immediately scan your external attack surface for applications running vulnerable versions of React Server Components.
Review Supply Chain Access: In light of the IKAD breach, review the access privileges of third-party vendors and enforce strict MFA.
Insider Threat Monitoring: Ensure your offboarding procedures instantly revoke access, especially for high-risk accounts.

Contact us for a quote for penetration testing service or adversary simulation.