A newly discovered vulnerability, dubbed the HTTP/2 Bomb, allows for remote denial-of-service (DoS) attacks on several major web servers, including NGINX, Apache, Microsoft IIS, Envoy, and Cloudflare. This exploit takes advantage of a flaw in the default HTTP/2 configuration of these servers, enabling attackers to launch a DoS attack. The vulnerability was identified by chaining OpenAI Codex, highlighting the potential for artificial intelligence to uncover complex security issues. The affected servers are widely used, making this vulnerability a significant concern for organizations relying on these technologies. The HTTP/2 Bomb vulnerability can be used to overwhelm a server, rendering it inaccessible to legitimate users1. This vulnerability matters to practitioners because it can be exploited by attackers to take down critical web infrastructure, emphasizing the need for prompt patches and configuration updates to prevent such attacks.