Skip To Main Content
Bar Menachem on Muck Rack

Bar Menachem

As seen in: Security Boulevard
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile

Get in touch with Bar

Contact Bar, search articles and posts on X, monitor coverage, and track replies from one place.

Learn more about Muck Rack

Actions

Share this page

Is this you?

As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile

Articles

Imperva Customers Protected Against “wp2shell” Pre-Authentication RCE in WordPress Core Original

|
By Bar Menachem, Muly Levy
| imperva.com
TL;DR: A critical pre-authentication Remote Code Execution (RCE) vulnerability, dubbed “wp2shell,” has been identified in WordPress Core. This vulnerability allows an unauthenticated attacker to execute arbitrary code on a vulnerable WordPress installation without any preconditions, such as plugins or specific configurations. Given that WordPress powers over 500 million websites, this vulnerability poses a significant risk to the global web ecosystem.
Open in Who Shared View Duplicates (2) Issue with article?

Imperva Customers Protected Against CVE-2026-49975 (HTTP/2 Bomb) DoS

|
By Bar Menachem
| Security Boulevard Verified
TL;DR: CVE-2026-49975, dubbed the “HTTP/2 Bomb,” is a critical remote Denial-of-Service (DoS) vulnerability affecting default HTTP/2 configurations of major web servers including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. Discovered by security firm Calif using OpenAI’s Codex, the attack combines a unique HPACK compression bomb variant with a Slowloris-style flow-control window hold to cause immediate server outages and memory exhaustion.
Open in Who Shared Issue with article?

Imperva Customers Protected Against CVE-2026-49975 (HTTP/2 Bomb) DoS

|
By Bar Menachem, Muly Levy
| imperva.com
TL;DR: CVE-2026-49975, dubbed the “HTTP/2 Bomb,” is a critical remote Denial-of-Service (DoS) vulnerability affecting default HTTP/2 configurations of major web servers including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. Discovered by security firm Calif using OpenAI’s Codex, the attack combines a unique HPACK compression bomb variant with a Slowloris-style flow-control window hold to cause immediate server outages and memory exhaustion.
Open in Who Shared Issue with article?
See all 7 articles