Cybersecurity briefing, 2026-06-04

The HTTP/2 Bomb everyone is talking about isn't a new bug.

• WordPress Form Bug Hands Out Admin Access
• New Kirki Release Put Admin Accounts at Risk
• Internet-Exposed ATGs Become Remote Control Points
• Leaked DentaQuest Data Fuels Identity Abuse
• Agent Skills Become the New AI Supply Chain
• npm Worm Bypasses Script Checks Via Build Metadata
• Executive Mailbox Became a Market-Intel Source
• Encrypted Vault Copies Outlive the Lockout
• HTTP/2 Defaults Share a Fast Memory-Exhaustion Path
• AI Shortens the EDR Bypass Loop
• Notification Summaries Can Become an Action Channel
• Minecraft Mods Now Feed a Credential-Theft Service
• Crypto Scam Rings Lost Their Operating Rails
• Fake Software Sites Now Filter Who Sees the Malware
• RTU500 Firmware Advisory Spans Multiple Branches
• Verified Ads Keep Mac Malware in Rotation
• Pashto Lures Mask Espionage in Afghan Finance Campaign

Recent editions

• Wednesday, June 3, 2026: New Kirki Release Put Admin Accounts at Risk · 18 stories
• Tuesday, June 2, 2026: AI Shortens the EDR Bypass Loop · 6 stories
• Monday, June 1, 2026: Support Access Becomes a WordPress Admin Backdoor · 4 stories
• Sunday, May 31, 2026: Support Access Becomes a WordPress Admin Backdoor · 2 stories
• Saturday, May 30, 2026: Poisoned Developer Tools Open Repo-Scale Credential Theft · 12 stories
• Friday, May 29, 2026: Residential Proxies Hide Abuse Behind Trusted IPs · 16 stories
• Thursday, May 28, 2026: Leak Count Exceeds Carnival's Formal Notice · 19 stories