Cybersecurity briefing, 2026-06-04

The HTTP/2 Bomb everyone is talking about isn't a new bug.

• WordPress form bug hands out admin access
• New Kirki release put admin accounts at risk
• Internet-exposed ATGs become remote control points
• Leaked DentaQuest data fuels identity abuse
• Agent skills become the new AI supply chain
• npm worm bypasses script checks via build metadata
• Executive mailbox became a market-intel source
• Encrypted vault copies outlive the lockout
• HTTP/2 defaults share a fast memory-exhaustion path
• AI shortens the EDR bypass loop
• Notification summaries can become an action channel
• Minecraft mods now feed a credential-theft service
• Crypto scam rings lost their operating rails
• Fake software sites now filter who sees the malware
• RTU500 firmware advisory spans multiple branches
• Verified ads keep Mac malware in rotation
• Pashto lures mask espionage in Afghan finance campaign

Recent editions

• Wednesday, June 3, 2026: Encrypted vault copies outlive the lockout · 18 stories
• Tuesday, June 2, 2026: AI shortens the EDR bypass loop · 6 stories
• Monday, June 1, 2026: Support access becomes a WordPress admin backdoor · 4 stories
• Sunday, May 31, 2026: Residential proxies hide abuse behind trusted IPs · 2 stories
• Saturday, May 30, 2026: Poisoned developer tools open repo-scale credential theft · 12 stories
• Friday, May 29, 2026: Residential proxies hide abuse behind trusted IPs · 16 stories
• Thursday, May 28, 2026: Leak count exceeds Carnival's formal notice · 19 stories