/
Navigation
Chronicles
Browse all articles
Explore
Semantic exploration
Research
Entity momentum
Nexus
Correlations & relationships
Story Arc
Topic evolution
Drift Map
Semantic trajectory animation
Posts
Analysis & commentary
Pulse API
Tech news intelligence API
Browse
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
Concept Search
Semantic similarity search
High Impact Stories
Top coverage by position
Sentiment Analysis
Positive/negative coverage
Anomaly Detection
Unusual coverage patterns
Analysis
Rivalry Report
Compare two entities head-to-head
Semantic Pivots
Narrative discontinuities
Crisis Response
Event recovery patterns
Connected
Search: /
Command: ⌘K
Embeddings: large
TEXXR

Chronicles

The story behind the story

days · browse · Enter similar · o open

Cybersecurity company Calif says it used Codex to discover HTTP/2 Bomb, a remote DoS exploit affecting web servers like Nginx, Apache HTTPD, and Microsoft IIS

Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX

The Hacker News

Context & Ripple Effects

HTTP/2 implementation flaws have repeatedly created broad denial-of-service exposure across web infrastructure. Related coverage of Rapid Reset showed that remediation depends on every affected web server being patched, while earlier Apache coverage documented the operational difficulty of addressing actively exploited server flaws.

Calif's reported use of Codex to find another HTTP/2-based remote DoS path matters because it links a widely deployed protocol surface to AI-assisted security research and to three major server families: Nginx, Apache HTTPD, and Microsoft IIS.

First-order effects

  • Operators using affected Nginx, Apache HTTPD, or Microsoft IIS deployments must assess exposure and apply vendor mitigations or patches as they become available.
  • Calif's finding gives server vendors and defenders a concrete new test case for HTTP/2 handling, while potential attackers gain attention around a remotely triggerable availability weakness.

Second-order effects

  • Hosting providers, CDNs, and enterprises may tighten HTTP/2 monitoring and request-handling limits, since unpatched or inconsistently patched server fleets can remain reachable through shared infrastructure.
  • The finding increases pressure on web-server maintainers to coordinate remediation and communicate deployment guidance quickly; Rapid Reset coverage showed that partial patching leaves the wider ecosystem exposed.

Third-order effects

  • If AI-assisted discovery continues to surface protocol-level flaws, the advantage of finding high-impact bugs may shift toward teams that can pair model output with rigorous validation and responsible disclosure.
  • The recurring HTTP/2 DoS pattern points to web-server resilience becoming an ecosystem problem rather than a single-vendor patching task, with security depending on adoption across operators and intermediaries.

The trend: AI-assisted vulnerability research is accelerating scrutiny of common internet protocols, raising the importance of coordinated, fleet-wide mitigation for shared infrastructure flaws.

Discussion

  • @xorninja @xorninja on x
    When the team walked me through this research, I found myself back in 2012. That year, @julianor and I discovered CRIME, a compression oracle that recovered cookies from compressed HTTP headers. I was at Google at the time, so I was asked to review the fix, which became part of
  • @mysk_co @mysk_co on x
    While nginx and Apache httpd are patched, Microsoft IIS isn't. Microsoft is again too slow to address a vulnerability. Will Microsoft take legal action against this disclosure?
  • @calif_io @calif_io on x
    Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex. Blog post: https://blog.calif.io/... PoCs: https://github.com/...
  • @tdp_org@mastodon.social Neil Craig on mastodon
    Does anyone know if h3/QUIC is likely vulnerable to HTTP/2 Bomb?  —  I guess it might well be since h3 is essentially h2 over QUIC but unsure if QPACK or implementations handle things differently.  —  https://blog.calif.io/...