Half of exposed React servers remain unpatched amid active exploitation