pwn.watch: AWS incident updates

[high] LexisNexis breach (FulcrumSec claims React2Shell path)

Tue, 31 Mar 2026 00:00:00 GMT

In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.

Status: closed · Patch: patched

CVEs: CVE-2025-55182

[critical] Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)

Thu, 06 Mar 2025 00:00:00 GMT

North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-03-06: Safe{Wallet} confirms a developer machine compromise by TraderTraitor (source)
2025-02-26: FBI attributes the theft to North Korea ('TraderTraitor') (source)
2025-02-21: About $1.5B in ETH drained from a Bybit cold wallet

[high] HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)

Tue, 10 Oct 2023 00:00:00 GMT

Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.

Status: closed · Patch: patched · Fixed in: See vendor advisories (each HTTP/2 implementation shipped its own fix)

Latest updates:

2023-10-10: Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV (source)
2023-08-25: Cloudflare starts seeing unusually large HTTP/2 attacks (source)

CVEs: CVE-2023-44487