A critical zero-day vulnerability in the HTTP/2 protocol was exploited by threat actors in August 2023 to deliver the largest distributed denial-of-service (DDoS) attack in history. According to the service providers Amazon Web Services, Google Cloud, and Cloudflare, at scale this attack was approximately eight (8) times greater than the size of the previous record for DDoS attacks. The vulnerability, tracked as CVE-2023-44487, is the result of a HTTP/2 Rapid Reset, which allows network analysts (or hackers) to quickly send and cancel HTTP requests in rapid succession, “thereby circumventing the server’s concurrent stream maximum and overloading the server without reaching its configured threshold.” The threat actors sent hundreds of thousands of HTTP/2 streams and rapidly canceled them at scale, ultimately overwhelming websites and taking them offline. Multiple companies have released software updates to mitigate the exploitation of this feature. The United States Cybersecurity and Infrastructure Security Agency (CISA) recommends that organizations who provide HTTP/2 services should apply patches when available and consider configuration changes and other mitigations discussed in the CISA advisory linked below. CTIX analysts will continue to monitor the outcome of this exploitation as more companies mitigate the threat and will provide an update if applicable.