<p><strong>TLDR:</strong> A maximum-severity unauthenticated RCE in React Server Components (CVE-2025-55182) is escalating fast, with cryptominers, a novel Linux backdoor, and blockchain-based C2 all observed in the wild. The axios npm package was also hit by a supply chain attack in March, with North Korean actors now suspected. On the framework side, Svelte’s June update brings breaking changes to remote functions and a new async-iterable subscription API, while Astro’s May recap covers two minor releases and an early Astro 7 alpha. Lighthouse 13.3 quietly added an ‘Agentic Browsing’ audit category that’s worth knowing about.</p>
<hr>
<h2>React2Shell (CVE-2025-55182) is actively exploited at Log4Shell scale</h2>
<p>A CVSS 10.0 unauthenticated RCE in React Server Components — caused by unsafe deserialization of the RSC Flight protocol — is being actively exploited across Next.js, React Router, Waku, and RedwoodSDK. Attackers are deploying XMRig cryptominers, a Linux backdoor called PeerBlight that uses BitTorrent DHT as a C2 fallback, and a reverse proxy tunnel called CowTunnel. One campaign (EtherRAT) uses an Ethereum smart contract for resilient C2 resolution and runs five post-compromise payloads entirely fileless via Node.js. The only real fix is patching to React 19.0.1, 19.1.2, or 19.2.1 and the corresponding Next.js versions. Cloudflare, Vercel, and Google Cloud Armor have deployed WAF mitigations as a stopgap. <a href="https://app.daily.dev/feed-by-ids?id=ZincNPkod&amp;id=7AajFhLjh&amp;id=mk60zl79X&amp;id=SzhGGXko7" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>axios npm package hit by supply chain attack, North Korean actors suspected</h2>
<p>On March 31, 2026, an attacker compromised the axios lead maintainer’s npm credentials and published two backdoored releases (axios@1.14.1 and axios@0.30.4) with a phantom dependency whose postinstall script deployed a cross-platform RAT. The attack lasted about three hours, but Huntress observed 135 endpoints contacting the attacker’s C2. The RAT supported credential theft, in-memory injection, and arbitrary script execution. Multiple indicators now point to BlueNoroff/UNC1069. If you’re running axios in CI or production, check your lockfile and rotate credentials from any affected systems. <a href="https://app.daily.dev/posts/NH53CBDlo" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Svelte June 2026: breaking changes to remote functions, new real-time subscription API</h2>
<p>The June Svelte update has a few things that will break existing code. The <code>requested()</code> function now requires a <code>limit</code> parameter, and the <code>enhance</code> callback API has been revamped. On the upside, <code>query.live()</code> is now async-iterable for long-lived real-time subscriptions, <code>query.batch()</code> is new, and form <code>submit</code> returns a boolean for validity. TypeScript 6.0 support lands across the language-tools packages. If you’re on SvelteKit with remote functions, read the changelog before upgrading. <a href="https://app.daily.dev/posts/GAwi5oJK2" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Astro May 2026: versions 6.3, 6.4, Starlight 0.39, and an early Astro 7 alpha</h2>
<p>May was busy for Astro. Version 6.3 adds experimental advanced routing with Hono support, 6.4 ships a pluggable Markdown pipeline and a Rust-based Markdown processor, and Starlight 0.39 brings flexible autogenerated sidebars. The Astro 7 alpha continues with Vite 8 support and a stable Rust compiler. Notable adopters this month include Express.js and Mistral AI. TinaCMS also adopted Astro as its default starter template. <a href="https://app.daily.dev/posts/bO5ujLvT4" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Lighthouse 13.3 adds an Agentic Browsing audit category:</strong> Lighthouse 13.3 introduces four new checks under an ‘Agentic Browsing’ category: accessibility tree well-formedness, CLS detection, WebMCP implementation validation, and llms.txt compliance — available now via the CLI, not yet in PageSpeed Insights or Chrome DevTools. <a href="https://app.daily.dev/posts/dGUegOldM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Harry Roberts: the TBT Window explains why TBT can spike without your JS getting worse:</strong> A preload hint for an LCP image caused a client’s TBT to jump 10x by shifting TTI later and expanding the measurement window to include previously out-of-scope long tasks — Roberts recommends monitoring TBT and TTI together and treating TBT as a regression only when it moves independently of TTI. <a href="https://app.daily.dev/posts/mPJCCg4Wn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>django-integrity-policy adds Integrity-Policy header support for Chrome 138+ and Firefox 145+:</strong> A new Django middleware package enforces subresource integrity on all scripts and stylesheets via the Integrity-Policy HTTP header, pairing with django-sri for hashed static file tags. <a href="https://app.daily.dev/posts/PzNZFgj4j" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Servo 0.2 ships with a 30% smaller Android APK and new web platform features:</strong> Servo 0.2 includes a revamped Android browser UI, a 30% smaller APK, the HTML select multiple attribute, new CSS features, and experimental IndexedDB support in Servoshell. <a href="https://app.daily.dev/posts/Um6JSFfN7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PGlite runs full PostgreSQL integration tests in under 3 seconds with no Docker:</strong> @electric-sql/pglite compiles PostgreSQL to WebAssembly and runs it in-process, enabling end-to-end tRPC router tests with real SQL, JSONB, foreign keys, and gen_random_uuid() in under 3 seconds. <a href="https://app.daily.dev/posts/JEMyrX7sy" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A CVSS 10.0 unauthenticated RCE (CVE-2025-55182) in React Server Components is being actively exploited across Next.js, React Router, and other frameworks, with cryptominers, a Linux backdoor using BitTorrent DHT for C2, and a fileless Ethereum-based RAT campaign observed in the wild. The fix requires patching to React 19.0.1+ and corresponding Next.js versions. The axios npm package was also hit by a supply chain attack in March, with North Korean actors suspected, affecting 135 endpoints. On the framework side, Svelte's June update introduces breaking changes to remote functions and a new async-iterable subscription API with TypeScript 6.0 support. Astro's May recap covers versions 6.3 and 6.4 with Hono support, a Rust-based Markdown processor, and an early Astro 7 alpha with Vite 8. Lighthouse 13.3 adds an Agentic Browsing audit category covering accessibility tree, CLS, WebMCP, and llms.txt checks.

React2Shell RCE hits Next.js at scale, Svelte and Astro ship June updates