Updates to close a critical vulnerability in React servers are incomplete. More and more attackers are exploiting the leak.