Dean Corso

CVE-2025-55182 dropped. CVSS 10.0. React Server Components. The Slack channel exploded. Forty-seven messages in twelve minutes. I responded with a fire emoji. Leadership. My threat intel team sent me six GitHub links. I clicked none of them. But I forwarded all of them. To seventeen people. With "URGENT" in the subject line. Three exclamation points. That's how you know it's serious. Our vendor called. They said their WAF had "day-zero protections." I asked what that meant. They said "runtime-level coverage." I asked what that meant. They sent me a PDF. Fourteen pages. I read the executive summary. Four bullet points. Three of them said "AI-powered." I felt safe. I scheduled an all-hands. Mandatory. I showed a screenshot of Shodan results. Very red. Very scary. I said "React2Shell" four times. Each time more slowly than the last. I showed them a PoC from Twitter. It used child_process.exec. I said we blocked it. I didn't mention you'd have to deliberately expose that function. Which would be insane. Which no one does. Which makes blocking it meaningless. But the slide looked great. Green checkmark. "MITIGATED." A security engineer unmuted. She asked about prototype pollution. She asked about __proto__:then. She asked if we'd actually upgraded React. I said those were implementation details. I said we focus on outcomes, not outputs. I said our posture was defense-in-depth. She asked what layer was actually defending. I said, "All of them." She shared her screen. Our Next.js was three versions behind. I said version numbers were vanity metrics. She said the CVE literally lists affected versions. I said, "Let's parking-lot that." I never found the parking lot. The meeting ended. I posted a LinkedIn update. "Proud of our team's rapid response to React2Shell." Forty-three likes. Two comments from vendors. One recruiter DM. The engineer's Jira ticket sat in the backlog. Priority: Medium. We shipped a new feature instead. The breach came through prototype pollution. Exactly what she said. The WAF saw nothing. Because WAFs don't understand JavaScript deserialization. The postmortem was three hours. I facilitated. Root cause: "Sophisticated nation-state actor." Contributing factor: "Unclear internal communication." The engineer who raised the alarm? "Contributed to confusion during incident response." I'm keynoting at RSA next month. Topic: "Building a Culture of Cyber Resilience." I'm workshopping my opening line. "In today's threat landscape, the only certainty is uncertainty." The audience will nod. They always do.