Skip to main content
Bar Menachem on Muck Rack

Bar Menachem

As seen in: Security Boulevard
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile

Get in touch with Bar

Contact Bar, search articles and posts on X, monitor coverage, and track replies from one place.

Learn more about Muck Rack

Actions

Share this page

Is this you?

As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile

Articles

Imperva Customers Protected Against CVE-2026-49975 (HTTP/2 Bomb) DoS

|
By Bar Menachem
| Security Boulevard Verified
TL;DR: CVE-2026-49975, dubbed the “HTTP/2 Bomb,” is a critical remote Denial-of-Service (DoS) vulnerability affecting default HTTP/2 configurations of major web servers including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. Discovered by security firm Calif using OpenAI’s Codex, the attack combines a unique HPACK compression bomb variant with a Slowloris-style flow-control window hold to cause immediate server outages and memory exhaustion.
Open in Who Shared Issue with article?

Imperva Customers Protected Against CVE-2026-49975 (HTTP/2 Bomb) DoS

|
By Bar Menachem, Muly Levy
| imperva.com
TL;DR: CVE-2026-49975, dubbed the “HTTP/2 Bomb,” is a critical remote Denial-of-Service (DoS) vulnerability affecting default HTTP/2 configurations of major web servers including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. Discovered by security firm Calif using OpenAI’s Codex, the attack combines a unique HPACK compression bomb variant with a Slowloris-style flow-control window hold to cause immediate server outages and memory exhaustion.
Open in Who Shared Issue with article?

Imperva Customers Protected Against React Server Components (RSC) Vulnerability

|
By Bar Menachem
| imperva.com
Overview On December 3, 2025, the React and Next.js teams disclosed a critical security vulnerability (CVSS 10.0), identified as React2Shell, affecting applications that leverage React Server Components together with Server Actions or Server Functions. The React2Shell vulnerability stems from improper validation of client-supplied data within certain server-side React features.
Open in Who Shared Issue with article?
See all 5 articles