AI Weekly Malaysia

Cloudflare's H1 2026 DDoS report covers Jan-Jun, mitigating 23.2M network-layer attacks and 29.64T HTTP DDoS requests (~5,343 attacks/hour). 935 attacks exceeded 1 Tbps with a 519% QoQ surge in Q2, DNS floods rose to 40% of network-layer attacks, and Operation PowerOFF targeted 75,000 DDoS-for-hire users across 21 countries.

Why: If you run any public-facing infrastructure, DNS-based amplification attacks are now the dominant vector at 40% of network-layer attacks—review your DNS resolver exposure and upstream rate-limiting. The 1 Tbps attack volume means self-hosted mitigation is increasingly impractical; evaluate whether your CDN/WAF provider's DDoS tier covers hyper-volumetric attacks before you need it.

Cloudflare's 2026 H1 data shows media, production, and publishing was the most DDoS-targeted sector at 14.2% of all attacks, driven by wars in Ukraine and Iran plus the FIFA World Cup. Media saw nearly 4x the attacks of the second-most-targeted sector (gambling), with government entities jumping from 29th to 9th most targeted after the US-Iran war began.

Why: If you run any availability-critical service (news, events, payments, government portals), this data confirms DDoS protection is non-optional during geopolitical events. Malaysian builders serving real-time content or running election/civic platforms should verify their CDN/WAF DDoS mitigation tier now, not during a crisis window when a 2-hour outage is the entire attack goal.

Palo Alto Networks Unit 42 discovered Kimwolf v7, an Android/IoT botnet variant active since mid-2024 that now uses HTTP/2 flood attacks with complete browser fingerprints via the nghttp2 library, making DDoS traffic indistinguishable from legitimate browsing. The botnet targets Android TV boxes with ADB enabled on port 5555, uses Ethereum Name Service (ENS) and Tor .onion for resilient C2, and has split propagation into a separate external loader while the core binary handles DDoS and proxy relay.

Why: If you run web-facing services behind HTTP/2, this botnet's browser-fingerprint construction means traditional DDoS mitigation that inspects header patterns or rate-limits by request signature will struggle to separate attack traffic from real users. Builders should check whether their WAF or CDN provider has specific HTTP/2 flood detection that goes beyond header heuristics, and ensure any Android TV/IoT devices on their networks don't expose ADB on port 5555.

Cisco has confirmed active exploitation of CVE-2026-20349 (CVSS 8.6), a high-severity denial-of-service vulnerability in Secure Firewall ASA and FTD Software. An unauthenticated remote attacker can send a crafted HTTP request to the Remote Access SSL VPN service on affected devices, causing them to reload. The flaw stems from insufficient error checking when processing HTTP requests and affects devices with IKEv2 Remote Access VPN, SSL-VPN, or Zero Trust Network Access enabled across ASA versions 9.16 through 9.24 and FTD versions 7.0 through 7.6.

Why: If your organization runs Cisco ASA or FTD firewalls with SSL VPN, IKEv2 Remote Access VPN, or Zero Trust Network Access enabled, you should patch to the fixed versions listed in the advisory immediately—this is being actively exploited. If you don't manage Cisco firewall appliances directly, this has no actionable impact on your work.