Cybersecurity briefing — 2026-06-04
The HTTP/2 Bomb everyone is talking about isn't a new bug.
WordPress Form Bug Hands Out Admin Access
New Kirki Release Put Admin Accounts at Risk
Internet-Exposed ATGs Become Remote Control Points
Leaked DentaQuest Data Fuels Identity Abuse
Agent Permissions Create a Faster Failure Mode
npm Worm Bypasses Script Checks Via Build Metadata
Executive Mailbox Became a Market-Intel Source
Encrypted Vault Copies Outlive the Lockout
HTTP/2 Defaults Share a Fast Memory-Exhaustion Path
AI Shortens the EDR Bypass Loop
Notification Summaries Can Become an Action Channel
Minecraft Mods Now Feed a Credential-Theft Service
Crypto Scam Rings Lost Their Operating Rails
Fake Software Sites Now Filter Who Sees the Malware
RTU500 Firmware Advisory Spans Multiple Branches
Verified Ads Keep Mac Malware in Rotation
Pashto Lures Mask Espionage in Afghan Finance Campaign
Cybersecurity briefing — 2026-06-04
The HTTP/2 Bomb everyone is talking about isn't a new bug.
WordPress Form Bug Hands Out Admin Access
New Kirki Release Put Admin Accounts at Risk
Internet-Exposed ATGs Become Remote Control Points
Leaked DentaQuest Data Fuels Identity Abuse
Agent Permissions Create a Faster Failure Mode
npm Worm Bypasses Script Checks Via Build Metadata
Executive Mailbox Became a Market-Intel Source
Encrypted Vault Copies Outlive the Lockout
HTTP/2 Defaults Share a Fast Memory-Exhaustion Path
AI Shortens the EDR Bypass Loop
Notification Summaries Can Become an Action Channel
Minecraft Mods Now Feed a Credential-Theft Service
Crypto Scam Rings Lost Their Operating Rails
Fake Software Sites Now Filter Who Sees the Malware
RTU500 Firmware Advisory Spans Multiple Branches
Verified Ads Keep Mac Malware in Rotation
Pashto Lures Mask Espionage in Afghan Finance Campaign