{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:38:01.102Z",
  "tag": {
    "id": "aws",
    "label": "AWS",
    "isStack": false,
    "url": "https://pwn.watch/t/aws",
    "feed": "https://pwn.watch/t/aws/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "lexisnexis-breach-react2shell-claim",
      "title": "LexisNexis breach (FulcrumSec claims React2Shell path)",
      "url": "https://pwn.watch/i/lexisnexis-breach-react2shell-claim",
      "json": "https://pwn.watch/i/lexisnexis-breach-react2shell-claim.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "LexisNexis Legal & Professional (legacy systems / React frontend claim)",
      "tags": [
        "react",
        "aws",
        "lexisnexis",
        "data-breach"
      ],
      "cveIds": [
        "CVE-2025-55182"
      ],
      "affectedVersions": [
        "n/a (customer breach); alleged unpatched React Server Components / Next.js stack"
      ],
      "fixedVersions": [],
      "startedAt": "2026-02-24",
      "closedAt": "2026-03-31",
      "updatedAt": "2026-03-31",
      "summary": "In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.",
      "xPost": null
    },
    {
      "slug": "bybit-1-5b-hack-safe-wallet-february-2025",
      "title": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025",
      "json": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "Bybit cold wallet / Safe{Wallet} web UI",
      "tags": [
        "bybit",
        "safe-wallet",
        "crypto",
        "north-korea",
        "lazarus",
        "aws",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-02-21",
      "closedAt": "2025-03-06",
      "updatedAt": "2025-03-06",
      "summary": "North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.",
      "xPost": null
    },
    {
      "slug": "http2-rapid-reset-ddos-cve-2023-44487",
      "title": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487",
      "json": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "HTTP/2 protocol implementations (servers, proxies, CDNs)",
      "tags": [
        "node",
        "go",
        "java",
        "dotnet",
        "http2",
        "ddos",
        "cloudflare",
        "google",
        "aws",
        "nginx",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-44487"
      ],
      "affectedVersions": [
        "Most HTTP/2 implementations; see each vendor's advisory"
      ],
      "fixedVersions": [
        "See vendor advisories (each HTTP/2 implementation shipped its own fix)"
      ],
      "startedAt": "2023-08-25",
      "closedAt": "2023-10-10",
      "updatedAt": "2023-10-10",
      "summary": "Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "bybit-1-5b-hack-safe-wallet-february-2025",
      "incidentTitle": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-03-06",
      "title": "Safe{Wallet} confirms a developer machine compromise by TraderTraitor",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html",
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025"
    },
    {
      "incident": "bybit-1-5b-hack-safe-wallet-february-2025",
      "incidentTitle": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-02-26",
      "title": "FBI attributes the theft to North Korea ('TraderTraitor')",
      "body": null,
      "sourceUrl": "https://www.ic3.gov/psa/2025/psa250226",
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025"
    },
    {
      "incident": "bybit-1-5b-hack-safe-wallet-february-2025",
      "incidentTitle": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-02-21",
      "title": "About $1.5B in ETH drained from a Bybit cold wallet",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-10",
      "title": "Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-25",
      "title": "Cloudflare starts seeing unusually large HTTP/2 attacks",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    }
  ]
}