New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute

Multiple high-impact security incidents and active exploits were reported: a new single‑host HTTP/2 'Bomb' DoS can crash web servers in seconds; CISA warns of active exploitation of Linux kernel and Android vulnerabilities; a critical Kirki WordPress privilege‑escalation (CVE-2026-8206) is being exploited to hijack admin accounts; Acer is patching maximum‑severity zero‑days in Wave‑7 routers; a VS Code zero‑day enables one‑click theft of GitHub tokens; the WeedHack campaign has infected >116,000 Minecraft systems; and an AI‑built ransomware toolkit automates AD discovery and EDR evasion. Other