Security Posture Report - December 2025

Default platform protection level

Default protection is a fundamental defense capability of the Alibaba Cloud platform. It is designed to block large-scale attacks from malicious groups that target cloud customers. This protection leverages extensive cloud security threat intelligence and works out of the box without requiring any configuration.

In December 2025, the cloud platform's daily average for customers

• Blocked 7.228 billion attacks, a 7.65% increase from November.

• Blocked 26,400 attacking IPs, which is about the same as in November.

DDoS attack interception

In December, the Alibaba Cloud platform detected and intercepted a total of:

• 54,000 DDoS attacks, a 69.71% decrease from November.

• A peak DDoS attack of 2000 Gbps, a 4.76% decrease from November.

Malicious groups use Next.js RCE vulnerability for large-scale cloud attacks

On December 4, 2025, the Meta React core team and the Vercel Next.js team jointly published security notices that disclosed two critical vulnerabilities: CVE-2025-55182 (affects React) and CVE-2025-66478 (affects Next.js).

React is an open source frontend JavaScript library for building user interfaces (UIs). The Flight protocol used by React Server Components (RSC) contains a deserialization bug. This bug allows an attacker to craft a malicious request and execute arbitrary system commands on the server without authorization, which constitutes a remote code execution (RCE) vulnerability. Because Next.js is deeply integrated with and heavily relies on the RSC feature of React, it is also affected.

On December 5, the Alibaba Cloud security team observed multiple malicious groups begin to exploit this vulnerability in batch attacks. The malicious activities included host ransomware, malicious mining, and DDoS attacks.

The Alibaba Cloud security team responded immediately:

• Used default protection to block the source IPs of the malicious groups and warned cloud tenants about the security risk.

• Published detection rules for the Next.js vulnerability (CVE-2025-66478) in the Security Center Free Edition to help users promptly detect the threat.

We observed two clear trends during this attack:

1. Vulnerability weaponization is significantly faster

Less than two hours passed between the public release of the vulnerability's proof of concept (PoC) and the launch of large-scale attacks by malicious groups. This indicates that attackers have significantly improved their ability to weaponize and deploy exploits.

2. Attack strategies are more targeted

After the first group of attackers exploited the vulnerability, other groups quickly followed suit. They abandoned their usual attack payloads and redirected their resources to scan for and exploit the Next.js vulnerability. This demonstrates more advanced tactical adjustment and targeting.

(1) New important vulnerabilities

(2) List of other vulnerabilities frequently attacked recently

Security Center provides free detection for some of these vulnerabilities. For more comprehensive detection, you can use Security Center Enterprise Edition to perform deep scans and continuous monitoring.