New HTTP/2 Bomb Attack, Trump's AI Security Reviews, Android Zero-Day & The Patching Crisis
6/5/202612 min
A newly disclosed attack called HTTP/2 Bomb can crash major web servers in seconds using a single computer and a modest internet connection. Researchers say the attack combines two known techniques into a powerful memory-exhaustion exploit affecting widely used platforms including Apache, NGINX, Microsoft IIS, and Envoy. The attack also highlights a growing trend in cybersecurity research: the use of artificial intelligence to uncover dangerous combinations of existing vulnerabilities.
The episode also examines President Trump's new executive order creating a voluntary framework for reviewing advanced AI models before public release. The administration says the goal is to improve cybersecurity and national security visibility while avoiding mandatory regulation or licensing requirements.
Next, a new Cloud Security Alliance report warns that organizations are struggling to keep up with the growing volume of vulnerabilities. Security teams increasingly face difficult choices about which flaws to patch first as cloud environments, containers, APIs, and third-party software continue to expand the attack surface.
Finally, CISA warns that attackers are actively exploiting both a newly patched Android vulnerability and a years-old Linux flaw. The contrast highlights a simple reality: cybercriminals do not care whether a vulnerability is new or old. They care whether it remains exploitable.
Stories in this episode
HTTP/2 Bomb Can Crash Web Servers in Seconds
Researchers disclose a denial-of-service technique capable of exhausting server memory in under a minute, while OpenAI's Codex helps uncover a novel attack chain.
Trump Creates Voluntary AI Security Reviews as Government Seeks Visibility Into Frontier Models
A new executive order establishes voluntary reviews of advanced AI systems before public release, raising questions about visibility, oversight, and national security.
The Cybersecurity Industry's Patch-Everything Strategy May Be Breaking Down
A Cloud Security Alliance report suggests organizations are overwhelmed by vulnerability volume and increasingly forced to choose which risks to address.
CISA Warning Shows Attackers Don't Care Whether a Vulnerability Is New or Old
Active exploitation of both a newly patched Android flaw and an older Linux vulnerability demonstrates that attackers focus on opportunities, not disclosure dates.
Cybersecurity Today brings you the latest cybersecurity news, threat intelligence, breach reports, vulnerability disclosures, ransomware developments, cybercrime investigations, and security research affecting organizations around the world.
#Cybersecurity #CyberSecurityToday #InfoSec #CyberNews #Ransomware #ThreatIntelligence #VulnerabilityManagement #AndroidSecurity #LinuxSecurity #ArtificialIntelligence #HTTP2 #CISA #CloudSecurity #OpenAI #PatchManagement
Transcript preview
First 90 secondsJim Love· Host0:00
Cybersecurity Today would like to thank Material Security for supporting the podcast. Material Security provides faster, more complete detection and responses for email, identity, and data threats inside Google Workspace and Microsoft three sixty-five. Contact them at material.security. An HTTP two bomb can crash web servers in seconds. Trump creates a voluntary AI security review as the government seeks visibility into frontier models. The cybersecurity industry's patch strategy may be breaking down, and a CISA warning shows attackers don't care whether a vulnerability is new or old. This is Cybersecurity Today. I'm your host, Jim Love. Researchers have discovered a new denial-of-service technique called HTTP two BOM that can exhaust a web server's memory and take it offline in less than a minute. The attack targets HTTP two implementations used by major web servers, including Apache, Nginx, Microsoft's Internet Information Services, or IIS, and Envoy. What makes it unusual is that it doesn't require a botnet or a massive bandwidth. Researchers say a single computer on a hundred megabit connection could knock vulnerable servers offline