In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape.

This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment.

Here are this week’s highlights:

10-year-old phpBB flaw enables session hijacking

Researchers uncovered a critical authentication bypass in phpBB versions up to 3.3.16 and 4.0.0-a2. A single unauthenticated HTTP request can impersonate any user, including admins, exposing private messages and forum content, and providing full administrative control. phpBB users should upgrade immediately to 3.3.17 or the latest master branch. The issue, reported via HackerOne, received a patch within days, but thousands of active forums remain exposed.

Advertisement. Scroll to continue reading.

Velvet Ant maintained decade-long stealth in air-gapped critical infrastructure

China-nexus actor Velvet Ant compromised an organization’s segregated network starting around 2016. It chained internet-facing footholds, Nginx/FastCGI proxies, and backdoored PAM/OpenSSH components for credential theft and persistent access. The group deployed variants of GS-Netcat, SOCKS5 proxies, and nine pam_unix.so backdoors across hosts. Remediation proved complex.

MaXSS and Spyder flaws expose 10 million Chrome users to hacking

Critical vulnerabilities in SiderAI (Spyder) and MaxAI (MaXSS) agentic side-panel Chrome extensions can allow malicious websites to trigger arbitrary extension actions, including hidden tab screenshots, AI memory dumps, and potential file access. With over 10 million combined installs and no vendor response, the issues enable full browser session compromise and account takeovers without user interaction. Users should remove the extensions until fixed.

AWS unveils Continuum

AWS has announced a new AI-powered tool designed to help organizations discover, prioritize, validate, and resolve vulnerabilities. Available in gated preview, Continuum takes findings from existing tools and its own scanning, prioritizing them based on exploitability in the user’s own environment.

1.2 million WordPress sites compromised in OptinMonster supply chain attack

Attackers injected malicious JavaScript into Awesome Motive’s OptinMonster, TrustPulse, and PushEngage WordPress plugin CDN scripts. The payload activates for logged-in admins, creating rogue administrator accounts and a hidden backdoor plugin. The breach stemmed from a compromised UpdraftPlus instance and CDN key. The supply chain attack is believed to have hit more than 1.2 million WordPress sites.

FTC says imposter scams cost Americans $3.5 billion in 2025

The FTC reported imposter scams as the most common fraud category, with losses nearly tripling since 2020. Bank and government impersonation schemes drove the bulk of the damage, often via fake security alerts urging money transfers. Overall fraud losses hit a record $16 billion. The agency continues enforcement under its Impersonation Rule and supports public awareness campaigns.

US DOT closes investigation into Delta’s 2024 CrowdStrike outage response

The Department of Transportation ended its probe into Delta’s prolonged recovery from the global CrowdStrike incident without penalties. Investigators found the airline provided adequate refunds, baggage help, and support for passengers with disabilities. This aligns with the current administration’s shift away from certain Biden-era consumer protection enforcement approaches.

JetBrains Marketplace plugins steal developer AI keys

At least 15 malicious AI coding assistant plugins, published in the JetBrains Marketplace under various vendor accounts, exfiltrate OpenAI, DeepSeek, and similar API keys. The plugins have racked up nearly 70,000 installs while functioning as advertised. Keys are sent in plaintext to a hardcoded attacker server. The plugins also appear to resell stolen access to paying users.

Apple releases Beats firmware fixing unauthenticated mic access

Beats Studio Buds firmware update 1B211 patches CVE-2025-20701, which allowed nearby attackers to listen via the microphone on unpaired devices actively seeking connections. Updates apply automatically when paired with Apple devices. CVE-2025-20701 is one of three Bluetooth security issues disclosed last year, which have been found to impact devices from several major vendors.

Popa botnet tied to Israeli proxy provider

Researchers linked the large Popa Android TV box botnet — used for residential proxy traffic in ad fraud and scraping — to NetNut, operated by publicly traded Israeli company Alarum Technologies. Researchers said an SDK turns compromised streaming devices into persistent proxies. The operation involves millions of IPs daily and raises concerns about local network exposure and ties to data scraping. NetNut and Alarum have disputed the allegations calling them “demonstrably inaccurate assertions and flawed deductions rather than verified facts.”

GCP Config Connector enables org-wide IAM owner takeover

A confused deputy vulnerability in Config Connector lets any Kubernetes namespace user escalate to GCP Organization Owner by submitting a malicious IAMPolicyMember. Google acknowledged the issue internally as P1/S1 but later classified it as “working as intended” and left it unpatched. The bypass affects organizations using the service for organization-level management.

ShinyHunters leaks Knicks and MSG talent and customer data

Hackers published Madison Square Garden data, including details on Knicks-related “talent” (players, coaches, celebrities) with risk assessments, addresses, and contact info, along with customer correspondence. The dump follows a June 5 breach. ShinyHunters continues its pattern of public leaks to pressure victims.

https://www.securityweek.com/in-other-news-apple-patches-beats-eavesdropping-flaw-dot-closes-delta-crowdstrike-probe-aws-continuum/

Apple patches high-severity eavesdropping vulnerability in Beats Studio Buds

Security firm Sentinel One has a deeper dive into CVE-2025-20701 here.

Heinze and Steinmetz said last year that the full chain of attacks gave attackers the ability to do other malicious things, including retrieving call history and contacts, and even calling arbitrary numbers. Many of those capabilities are dependent on the specific devices being paired, since the functionality built into them differs from platform to platform.

Devices affected by the Airoha vulnerabilities are by no means alone. In January, researchers disclosed WhisperPair, a series of vulnerabilities that allows an attacker to hijack Bluetooth devices connected through Google Fast Pair, a proprietary protocol belonging to the company. Besides eavesdropping, attackers can exploit the WhisperPair flaws to geolocate devices. The vulnerabilities affect more than a dozen devices from 10 manufacturers, including Sony, Nothing, JBL, OnePlus, and Google itself.

There are few, if any, reports of Bluetooth vulnerabilities like these being actively exploited in the wild. The complexity of such attacks is often high, and an attacker has to continually stay within Bluetooth range of a target while utilizing the exploit. People who think they may be targeted by such attacks should turn off Bluetooth in devices whenever they’re not needed, and remain aware of the risks when Bluetooth is enabled.

https://arstechnica.com/apple/2026/06/apple-patches-high-severity-eavesdropping-vulnerability-in-beats-studio-buds/

No Exploits Required

Well hey y’all. I just got hooked up with this space to somewhat-routinely write about vulnerabilities, cybersecurity, and infosec history. I’m currently at runZero, where I’m the vice president of security research, which basically means that I spend most of my time hanging around with some incredibly bright and devoted people who are also cunning and shrewd. We’re all dedicated to the notion that it is, in fact, possible to secure networks by being smart and creative with your approaches to exposure management.

I’m so excited to be writing here, and you might expect me to go on and on about CVE identified vulnerabilities, and the CVE program itself. After all, I’m on the CVE board, and was most recently section chief for the KEV at CISA, and I’ve spent a fair amount of my career managing patch schedules, writing exploits and Metasploit modules, and detecting novel attacks on the network (so I often blather on Mastodon and Bluesky about CVEs).

But you’d be wrong! While I believe that CVEs are an important, even foundational, component of any modern security program (and I will explore aspects of individual CVEs and the program in the future), I’m not convinced that we should be totally infatuated with exploits and bugs. After four decades of personally responding to (and occasionally causing) cybersecurity incidents, it’s become clear to me that most people run into trouble not because they forgot to patch some critical internal database, but because the networking deck is stacked against the defenders.

TTRPGs and Predicting The Future

I remember in 1989 at DunDraCon, my first exposure to Cyberpunk 2020 by Mike Pondsmith and published by R. Talsorian. (You’ve probably heard of the multiplayer online game, Cyberpunk 2077; this pencil-and-paper table-top role playing game is that game’s direct ancestor.) Anyway, I saw the upcoming second edition being playtested during the conference, and me, being a teenage hacker, immediately gravitated toward the more fully-fledged “Netrunner” character class. We had a good time; the combat simulation was a lot more chaotic and swift than D&D, the cybernetic and neurological upgrades were way cooler than spells and potions, and of course, the theme of dystopian end-stage capitalism was infinitely attractive in a grim way.

Anyway, after playing a session, I was offered a comment card. Remember, this was the 80s, point-to-point networking reigned supreme, and to get anything done, you had to first figure out how to negotiate the handshake, puzzle out the protocol, and basically learn every operating system from scratch. So, my feedback was along the lines of, “I really liked the simulated hacking system, but it seems just a little too simplified and straight-forward. It’s unrealistic that in the future, nuclear power plants and banks would all be on the same networks that are known to be shot through with hackers and gangsters.”

Advertisement. Scroll to continue reading.

Oh, how wrong I was.

Universal Connectivity Is Great Except When It Isn’t

Fast forward to today, and there are just so many things that can go wrong when trying to secure a normal TCP/IP network, along with all the servers, desktops, clouds, phones, hypervisors and operational technology (OT) that’s been patched in. I’d argue that the first, fundamental problem defenders run into is the fact that planet Earth has settled on the whole “IP” part of TCP/IP. After all, the “I” stands for Internet, so given a long enough timeline, virtually everything that talks IP will end up exposed and reachable on the internet, and that’s both the coolest thing about TCP/IP, and its ultimate Achilles’ heel.

Recent events underline this fundamental flaw of modern networking when it comes to security. The 2026 M-Trends report from Google plays up the idea that “exploits represented the most frequently observed initial infection vector in 2025,” since exploited vulnerabilities account for 32% of all initial access vectors. That sounds like a lot!

Of course, the unspoken inverse of this stat is that 68% – over two-thirds – of all the rest of initial access attacks do not rely on technical vulnerability exploitation. The reason for this, of course, is because everything is reachable with enough ingenuity, time, and luck.

But what about Zero-Trust?

Security professionals have long known that the boundaries between internal and external networks are at best notional, defining today’s intrusion defense strategies. For about 15 years, “zero-trust” has been an aspirational end-state: identity and authorization bundled into every network transaction, regardless of origin. However, this path is often blocked by legacy systems that “can’t” be managed this way. Worse, even when CTOs and CISOs get comfortable with their carefully structured boundaries, someone invariably bridges a printer from the IT to the OT network, and shadow-IT hijinks ensue from there.

The standards chosen for TCP/IP are incredible in their interoperability, allowing systems to communicate freely, and routers actively bypass damaged connections, even when these broken connections are intentional blocks. While this fundamental interconnectivity is great for innovation and industry and commerce and entertainment and art and all that, it’s an absolute, quantifiable disaster for security.

The network itself is actively working against the idea that only some of these computers should be able to talk to some of these other computers, automatically and intelligently, without physically closing circuits or swapping cables. It’s no wonder that most breaches today can be traced back to an errant bridge here, or a misclicked email there, rather than a failure to patch.

Securing any enterprise is profoundly difficult due to these fundamental forces, giving hackers, criminals, and spies a seemingly permanent advantage in gaining and keeping access, no exploits required.

Going forward, I’ll be taking up some SecurityWeek column-inches to pursue all these side quests, like tracking end-of-life trends, investigating OT/IT convergence, and the so-called “Layer 8” human-centric issues of cybersecurity. And yes, expect the occasional indulgence in deep-dives on particularly interesting sets of technical software vulnerabilities, CVE-identified or otherwise.

https://www.securityweek.com/no-exploits-required/

Atlassian, Splunk Patch Critical Vulnerabilities

Atlassian and Splunk on Wednesday announced patches for multiple vulnerabilities in their products, including critical-severity flaws.

Splunk resolved a critical issue in AI Toolkit that could allow authenticated attackers with admin roles to execute arbitrary OS commands on the host the Splunk Enterprise instance runs on.

“The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation,” Splunk explains.

Tracked as CVE-2026-20266 (CVSS score of 9.1), the security defect was addressed in Splunk AI Toolkit version 5.7.4. If upgrading is not possible, Splunk recommends uninstalling the AI Toolkit as a mitigation.

The update also addresses CVE-2026-20265, a medium-severity information disclosure bug caused by an insecure default domain allowlist. An attacker holding the admin or power role could cause the AI Toolkit to make outbound HTTP requests to attacker-controlled servers, leading to data exfiltration.

Atlassian published 100 security bulletins that address dozens of security defects across Bamboo Data Center and Server, Bitbucket Data Center and Server, Confluence Data Center and Server, Crowd Data Center and Server, Fisheye/Crucible, Jira Data Center and Server, and Jira Service Management Data Center and Server.

Advertisement. Scroll to continue reading.

All the weaknesses resolved with the fresh security updates appear to affect third-party dependencies used in Atlassian’s products.

These include critical-severity issues in Axios (CVE-2026-42043, CVE-2026-40175, and CVE-2026-42264), Apache Tomcat (CVE-2026-41293, CVE-2026-43512, CVE-2026-41293, CVE-2026-43515, and CVE-2026-43515), and Netty (CVE-2026-42584).

Users are advised to update to a patched version of the affected Atlassian products as soon as possible.

https://www.securityweek.com/atlassian-splunk-patch-critical-vulnerabilities/

OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds

Including npm packages in software development projects saves time but can introduce unseen but known vulnerabilities.

CVE Lite CLI is a lightweight command line security scanner that operates on lockfiles during software development. It focuses on JavaScript and Typescript files and is an OSV-powered dependency scanner supporting npm, pnpm and Yarn.

It is an open source tool developed by Sonu Kapoor, now community supported and recently adopted as an OWASP Incubator Project.

Kapoor has been a software developer for 25 years and has experienced and understands all the frustrations and delays in the secure software development process. It is these frustrations and delays that CVE Lite CLI is designed to ease.

“Each project you build doesn’t simply contain your own code. It pulls in hundreds of open source packages. Each of those packages might pull in other packages with their own dependencies, until a typical JavaScript project might involve thousands of these dependencies,” he explains.

The developer has probably never heard of the majority and doesn’t know how they got included. At this stage the developer is flying blind. “Any one of those packages could have a known security vulnerability – and most developers have no idea it’s there.”

Advertisement. Scroll to continue reading.

SBOMs were introduced to solve this problem, especially within OSS. In theory, they should solve this problem; but SBOMs cannot be trusted, especially within OSS. Developers must use scanners to locate vulnerabilities in unknown but automatically included npm packages. Scanners exist, but they can often only be used at a non-optimal time, and do not provide fully optimal assistance.

“CVE Lite CLI is a free, open-source command line tool that scans your projects in seconds and tells you exactly which included packages contain a vulnerability. But it doesn’t just tell you what is broken – it tells you how to fix it: it is not simply a huge log or list of warnings,” he continues. “It uses its own internal algorithm to analyze any vulnerable dependency and provide the safest command to include an alternative non-vulnerable package that won’t break the application.”

The tool allows the developer to produce secure code as part of the process of coding.

Today, much coding is done with the assistance of an AI coding agent. An alternative approach would be to allow the AI to do the scanning; but that produces its own problems even if we ignore the current concern that AI agents are not sufficiently security aware.

“With AI, a scan in the CI is usually the last step that happens after all the other tasks, the npm run build, any linting, unit tests, building an image – and then it runs the CI scan. Depending on how big your project is, this could be a 10 minute thing, but in most enterprise companies I’ve worked in, it takes anywhere between one to two or three hours. And even that depends on an agent being free. So, in CI, if an agent isn’t free, you’re probably waiting another couple of hours before you see the result of the scan.”

So that’s the first issue: time wasted. Few developers have the time to just sit and wait for hours. Most will move on and start the next project – which produces the second issue: loss of context in the first project. Humans are no different to AI agents in this respect. Loss or lack of context can produce bad decisions. The effect of any lack of immediate context surfaces when the developer receives the result of the AI scan.

“Most of these AI scans give you a large log of problems but don’t give you any fixes. They might give you a coarse-grained command, such as ’This package has this CVE: fix it’, but they don’t tell you how to fix it. CVE Lite CLI will give you the command you need to replace the vulnerable npm with a safe npm package.”

The result is a combination of wasted time and increased frustration, all of which could be eliminated by securing the code and its npm or pnpm or Yarn inclusions as they are included during development. Each CVE Lite CLI runs on the developer’s own device, can be used on demand instantly, completes its scan within seconds, and helps fix any discovered vulnerable inclusions.

Needless to say, perhaps, it automatically scans the new npm that its recommended command brings in, ensuring that the proposed fix is a genuine fix. Kapoor cites an example from experience where the developer went through more than 25 separate iterations of seeking a safe alternative to a vulnerable npm package.

“Imagine the frustration,” he says. “You have to install the package. The CI scan says it contains a vulnerability, so you try a different npm. You push it up to CI, you wait for CI to run, and CI says you’re still vulnerable. Okay, so you try the next version. And you go into the same loop again: you push it up, you wait for CI, and it tells you again it’s vulnerable.” Imagine doing this 25 times. That’s a huge and frustrating waste of time.

The biggest problem is when such frustration and time-wasting becomes a hassle. “What can happen then,” he adds, “is that some developers start ignoring the vulnerability out of sheer frustration when they should be fixing it. CVE Lite CLI prevents this by running local scans within seconds, allowing the developer to see the problem, fix the problem, and then move on.”

Learn More at CodeSecCon – The event that defines how modern applications are built, secured, and maintained in the age of AI.

https://www.securityweek.com/owasp-incubator-project-helps-developers-find-and-fix-vulnerable-dependencies-in-seconds/

Chrome 149 Patches 429 Vulnerabilities

Google this week promoted Chrome 149 to the stable channel with patches for 429 vulnerabilities, a record for a single Chrome refresh.

Already exceeding several times the total number of Chrome security fixes released in 2025, the surge in Chrome flaws is likely driven by AI use, which led Google to lower Chrome bug bounties in April.

Over 100 of the newly resolved security defects are critical and high-severity issues, most of which are use-after-free and insufficient validation of untrusted input flaws.

The most severe of the bugs is CVE-2026-10881 (CVSS score of 9.6), an out-of-bounds read and write weakness in the ANGLE graphics engine.

Remote attackers could exploit the vulnerability to escape Chrome’s sandbox via crafted HTML pages, potentially achieving code execution on the underlying operating system.

In its advisory, Google says it handed out a $97,000 bug bounty reward to the external researcher who reported the issue.

Advertisement. Scroll to continue reading.

Two other critical-severity defects were reported by external researchers, namely CVE-2026-10882, a use-after-free issue in Network, which earned the reporting researcher a $43,000 reward, and CVE-2026-10883, an out-of-bounds write in ANGLE that was awarded a $5,000 bug bounty.

The remaining 19 critical-severity vulnerabilities addressed in this Chrome release were discovered by Google. Out of approximately 90 high-severity flaws, only 10 were reported by external researchers.

Approximately 40 of the over 300 medium and low-severity weaknesses resolved with the update were reported by external researchers.

Most of the patched weaknesses were use-after-free and insufficient validation of untrusted input issues. Numerous inappropriate implementation, insufficient policy enforcement, and out-of-bounds flaws were also addressed.

Google paid roughly $208,000 in bug bounty rewards to the reporting researchers, but the final amount could be much higher, as the company has yet to disclose the amounts for over a dozen reports.

The latest Chrome iteration is now rolling out as version 149.0.7827.53 for Linux and versions 149.0.7827.53/54 for Windows and macOS.

https://www.securityweek.com/chrome-149-patches-429-vulnerabilities/

Kirki, Burst Statistics WordPress Plugin Flaws in Attackers’ Crosshairs

Hundreds of thousands of websites are potentially exposed to attacks exploiting two vulnerabilities in the Kirki and Burst Statistics WordPress plugins, Defiant warns.

Kirki provides website and freeform page creation, and WordPress customizer enhancements. The plugin’s versions 6.0.0 to 6.0.6 are affected by an unauthenticated privilege escalation and account takeover bug.

Tracked as CVE-2026-8206 (CVSS score of 9.8), the issue impacted the plugin’s password reset flow, which allowed attackers to provide a username and an arbitrary email address and have a password reset key sent to that address.

“This means an unauthenticated attacker can send a request specifying a high-privileged username together with an attacker-controlled email address and receive a valid password reset link for the targeted account,” Defiant explains.

The attacker can then use the reset link to take control of the targeted account. By resetting the password for an administrative account, the attacker can take over the entire website.

A lightweight plugin for WordPress, Burst Statistics provides users with an intuitive analytics dashboard with insights into site traffic, visitor sources, page performance, and more.

Advertisement. Scroll to continue reading.

Versions 3.4.0 to 3.4.1.1 of the plugin were affected by an authentication bypass vulnerability that allowed unauthenticated attackers to elevate their privileges to administrator and take control of a vulnerable site.

The bug existed because the function responsible for validating application passwords from the Authorization header contained an incorrect return-value, allowing attackers to send a REST API request and impersonate an administrator for the duration of the request.

“The plugin incorrectly treats the request as authenticated and sets the current user to the supplied administrator account, allowing unauthorized access to administrator-level REST API functionality, such as creating a new administrator account,” Defiant notes.

The web protection firm says it has blocked thousands of attacks targeting these vulnerabilities over the past 24 hours and warns that hundreds of thousands of websites are potentially at risk.

Kirki has over 500,000 active installations, but only 150,000 sites are believed to be running a vulnerable plugin version. Burst Statistics has more than 200,000 active installations.

Users are advised to update to Kirki version 6.0.7 or newer, and to Burst Statistics version 3.4.2 or newer, which contain patches for the exploited security defects.

https://www.securityweek.com/kirki-burst-statistics-wordpress-plugin-flaws-in-attackers-crosshairs/

Organizations Warned of Exploited Linux Kernel Vulnerability

The US cybersecurity agency CISA on Tuesday warned of in-the-wild exploitation of a Linux kernel vulnerability that leads to container escapes.

Tracked as CVE-2022-0492 (CVSS score of 7.8), the issue is described as an improper authentication vulnerability that could allow attackers to elevate their privileges and bypass the namespace isolation.

The security defect was found in cgroups, the Linux kernel’s control groups feature that specifies which OS resources a group of processes can use. While there are two control group versions, only cgroups v1 is affected.

Together with namespaces, cgroups can be used for process isolation and to restrict access to certain resources, which makes the feature essential for container creation.

Due to the vulnerability, any user could modify the release_agent file residing at the root of the cgroup hierarchy, which runs as root within the cgroup namespace as part of cgroup v1’s notification mechanism when a cgroup becomes empty.

“It is then possible to create a malicious script that is located on the host filesystem that will be run as root as part of the cgroup notification process, essentially allowing for a container escape and privilege escalation,” HackTheBox explains.

Advertisement. Scroll to continue reading.

Additionally, the bug allowed attackers to create a new user namespace with admin privileges and then create a cgroup with a malicious release_agent file, triggering the exploit.

Technical details on CVE-2022-0492 were published roughly three years ago, but its in-the-wild exploitation was reported only this week, one day before CISA’s alert.

Kaspersky mentioned the exploitation of CVE-2022-0492 in a blog post describing attacks on container environments, but has not specified who is behind the attacks, nor who the victims are.

On Tuesday, the cybersecurity agency added the CVE to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it by June 5.

CISA also urged the immediate patching of CVE-2025-48595, a high-severity flaw in Android’s Framework component. Google patched the issue this week, warning that it has been exploited as a zero-day.

https://www.securityweek.com/organizations-warned-of-exploited-linux-kernel-vulnerability/

‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds

Known denial-of-service (DoS) techniques can be chained together in a new exploit that can knock major web servers offline, Calif security researchers warn.

Dubbed HTTP/2 Bomb and discovered using OpenAI’s Codex, the exploit combines a compression bomb that targets HTTP/2’s header compression scheme (HPACK) with a Slowloris-style hold that prevents the server from freeing memory.

According to California-based cybersecurity firm Calif, the attack potentially affects over 880,000 websites that support HTTP/2 and run default NGINX, Apache HTTPD, Microsoft IIS, Envoy, or Cloudflare Pingora configurations.

Furthermore, the company says, an attack can be launched from a home computer on a 100 Mbps connection and can render any of these servers unavailable within seconds.

The techniques chained by the exploit are not new. In fact, three of the underlying issues were disclosed a decade ago, while another was resolved last year.

The first part of the exploit uses HPACK Bomb (tracked as CVE-2016-6581), a compression-layer attack relying on small messages that turn into gigabytes of data once they reach the destination server.

Advertisement. Scroll to continue reading.

Last year, the attack was demonstrated against Apache HTTPD with a 4000x amplification rate, and was resolved in Apache HTTP Server version 2.4.64 as CVE-2025-53020.

The second part of the new exploit targets CVE-2016-8740 and CVE-2016-1546 (Slow Read), two Apache HTTPD flaws leading to DoS conditions via Continuation frames in an HTTP/2 request and via modified flow-control windows.

These HTTP/2 Slowloris-type issues are abused for memory exhaustion by advertising a zero-byte flow-control window so that the server does not send a response, and then resetting the send timeout to prevent the server from freeing memory allocations.

“What’s new here is where the amplification comes from. The classic bomb stuffs a large value into the table and references it repeatedly, so servers learned to cap the total decoded header size,” Calif notes.

“Our variant goes the other way: the header is nearly empty, and the amplification comes from the per-entry bookkeeping the server allocates around it. The decoded-size limit never fires because there’s almost nothing to decode,” the company explains.

Calif also identified a bypass for servers that cap the header-field count, and released proof-of-concept (PoC) code to demonstrate the attack.

The company says NGINX resolved the bug in April, while Apache rolled out fixes in late May (and issued CVE-2026-49975). Microsoft IIS, Envoy, and Cloudflare Pingora have not been patched at the time of writing.

“The other thing worth noting is how this exploit was found. Both halves have been public for a decade. What Codex did was read the codebases, recognize that the two compose, and build the combined attack. That combination is obvious once you see it, and yet as far as we can tell no human had put it together against these servers,” Calif notes.

https://www.securityweek.com/http-2-bomb-exploit-knocks-web-servers-offline-in-seconds/

Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis

Two reports offer differing viewpoints. One suggests a failure of tools to provide what security teams really need. The other suggests the tools exist but are not properly managed.

The industrialization of cybercrime threatens to overwhelm cyber defense. It’s a process that started before the arrival of ChatGPT, was supercharged by the age of AI, and is now typified as the post-Mythos era. It’s a time when defenders must improve their performance or cede the battleground to the adversary. Applications are the battlefield. The speed, scale and sophistication of AI-assisted attacks is difficult to contain.

“AI is not just creating more vulnerabilities. It is exposing the fact that companies cannot fix known vulnerabilities fast enough,” explains Daniel Shechter, CEO and co-founder at Miggo Security. “For years, security programs have been measured by how well they find risk before software goes live. Frontier AI like Mythos changes the question. If attackers can move from disclosure to exploit in hours, boards and CISOs need to understand how long the business remains exposed, and what can be done to mitigate quickly and efficiently.”

The Cloud Security Alliance (CSA) State of Modern Application and AI Security report (PDF), commissioned by Miggo and published on June 2, 2026, confirms and explains this new reality. CSA surveyed more than 900 cybersecurity leaders and found that vulnerabilities in this post-Mythos era are evading the pre-production phase while 82% of organizations lack effective runtime visibility.

“The real challenge begins once applications are in production, where security teams must rapidly determine which exposures are truly exploitable, prioritize the risks that matter most, and respond before attackers can take advantage,” suggests Daniel Shechter, CEO and co-founder at Miggo Security.

Most breaches are driven by known vulnerabilities. Eighty percent of the companies surveyed have suffered at least one incident involving a known vulnerability in the last year. If it is known, it is almost certainly patchable; but in the post-Mythos era there are too many patches to handle. The biggest problem is knowing which of those vulnerabilities are exploitable and most urgently need patching.

Advertisement. Scroll to continue reading.

Only 9% remediate critical vulnerabilities within 24 hours; with74% take one to seven days. Patch time is important: Organizations taking four or more days had a 97% incident rate. Those taking three or less had a 67% rate. The implication is that patch rates must be increased and exploitable vulnerabilities better understood – and preferably both.

It gets more complicated, and urgent, in runtime, which is described as the breach battlefield. Most organizations only know what happened after reconstructing the event after the horse has bolted. Most (73%) would adopt virtual patching if they had better confidence in minimal false positives; but only 17% configure WAFs for automatic blocking, with 56% citing a lack of application context as the reason.

Because of the runtime difficulties, there is an intention by 42% of the organizations to increase investment in runtime monitoring and protection over the next few years. But since protection is always better than cure, the bulk of investment (52%) remains in pre-production such as CI/CD build protection.

The potential solutions are clear. Improved visibility into vulnerability exploitability together with better all-round contextual understanding of the application concerned – and its effect on business stability – would allow autonomous patching for many vulnerabilities and confidence in increased automated blocking.

A separate FireMon Insights report, also published June 2, 2026, suggests that concern over the automated use of firewalls as a security barrier is unsurprising but at least partially due to a lack of human oversight. FireMon discusses firewalls in general, but the same principles will apply to WAFs.

“Firewall complexity is no longer just an operational problem. It is a control problem,” says Jody Brazil, CEO at FireMon. “Security teams have massive investments in firewalls, cloud, and segmentation platforms, but without control of policy those environments become difficult to manage securely. The problem is no longer lack of tools. It is lack of operational control.”

It concludes that manual policy management is inefficient and allows risk across the attack surface to continue to expand rapidly, primarily due to an environment in which high severity policy failures persist over extended periods of time, and are exacerbated by unused and redundant rules.

FireMon suggests a failure in human management rather than firewall capability. For example, 45% of firewall rules lack an owner or documentation, 17% are redundant or shadowed, and 69% are unused.

“Firewall complexity is no longer just an operational problem. It is a control problem,” adds Brazil. “Security teams have massive investments in firewalls, cloud, and segmentation platforms, but without control of policy those environments become difficult to manage securely. The problem is no longer lack of tools. It is lack of operational control.”

While this suggests a route toward better usage of firewalls, it doesn’t discuss or explain the fear that contextually incorrect blocking rules might adversely affect business operations – which lies at the heart of improving application security.

The two reports are, however, slightly at odds. The CSA report suggests the problem is a failure of security tools to provide the solutions really necessary, while the FireMon report suggests the tools exist, but are not being properly managed.

https://www.securityweek.com/two-new-reports-offer-competing-explanations-for-cybersecuritys-growing-crisis/