Threat actors exploit HTTP/2 vulnerability