Next.js Post Exploitation Child Process Spawn

Tim Peck@timpeck

•updated Dec 4, 2025•39•1•645

Detects the spawning of a shell process from a Node.js or Next.js server process, which is a strong indicator of post-exploitation activity following a Remote Code Execution (RCE) vulnerability like CVE-2025-55182 or CVE-2025-66478.