Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Top tips is a weekly column where we break down what's shaping the tech landscape and share practical ways you can stay informed and protected. This week, we’re looking at why safeguarding the health data collected by wearables is just as important as tracking your fitness goals. Wearables don't just track steps and sleep, they collect some of the most intimate health information we have, including: heart rate, blood sugar, medication routines, stress levels, and sleep patterns.

Designated CVE-2025-55182 and widely dubbed "React2Shell," this vulnerability represents a worst-case scenario for modern web applications: Unauthenticated Remote Code Execution (RCE) on default configurations.

Data is no longer confined to a few clean relational systems. It now flows through microservices, data lakes, event streams, vector databases, and LLM pipelines. Sensitive information spreads quickly, and once it reaches ungoverned surfaces—logs, analytics exports, embeddings—it becomes extremely painful to unwind. Tokenization is one of the few controls that can both minimize data exposure and preserve business functionality.

On 29 November 2025, researcher Lachlan Davidson reported a critical React vulnerability that allows unauthenticated remote code execution via specially crafted React Server Function payloads. This vulnerability was disclosed as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) and is rated CVSS 10.0. A public proof concept has also been released so patching is of utmost importance.

On December 3 2025, the React team released patched versions of the affected React Server Components packages. Framework vendors, including Next.js, provided updated builds on the same day. Any environment using React Server Components or frameworks that embed the RSC pipeline should.