🔴 VS Code Zero-Day, 💣 HTTP/2 Bomb DoS, 📱 Microsoft Android Debug Flag, 🎯 HazyBeacon AWS C2, 🖼️ Kirki WordPress Exploit, 🏛️ Trump AI EO

The VS Code zero-day is the day's defining story. A single click in github.dev leaks full-scope GitHub OAuth tokens, granting read and write access to every repository the victim can reach, and the public PoC ships with no patch available. The token is not scoped to a single repository, which turns one bad click into a developer supply chain compromise. Clearing github.dev cookies is a stopgap, not a fix.

The HTTP/2 Bomb is the second headline. An AI-discovered chained DoS exhausts 32 GB of server memory in under a minute against nginx, Apache, IIS, Envoy, and Pingora in default configurations, with amplification ratios up to 5,700:1 and 880,000+ exposed endpoints. nginx and Apache have patches; IIS, Envoy, and Pingora do not, so disabling HTTP/2 or fronting with a header-count cap is the only control.

Six Microsoft 365 Android apps shipped with a debug flag enabled, letting any app on the device steal FOCI account tokens; Microsoft patched in May. On the campaign side, HazyBeacon weaponizes AWS Lambda Function URLs as stealthy C2 relays against Southeast Asian governments, and Mustang Panda sideloads PlugX through a legitimate G DATA binary. A joint CISA, FBI, and NSA advisory confirms active attacks on automatic tank gauge systems, with leak-detection alarms and pump controls at physical risk.

Watchlist: block or monitor github.dev, apply HTTP/2 mitigations to unpatched servers, update Microsoft Android apps, and remove internet-facing ATG systems.