Loading story…
PortSwigger Research disclosed an AI-assisted system called HTTP Terminator that autonomously generated, tested, and weaponized novel HTTP desynchronization and request smuggling techniques against authorized live targets. The pipeline, published on GitHub as a multi-stage research framework, reportedly produced tens of thousands of candidate vectors from RFC-derived fragments and led to multiple real-world findings, including new desync triggers, a dual-matching Content-Length desync pattern, a dangling-byte weaponization method to improve response queue poisoning, and evidence of a possible new class dubbed response forking. The work also uncovered and helped patch Apache Traffic Server zero-day CVE-2026-63078, while exposing exploitable issues involving F5 Big-IP, BeyondTrust Secure Remote Access, Citrix NetScaler, and some Azure Application Gateway plus Akamai deployments.
A related PortSwigger paper detailed CRLF-powered desync attacks that turn HTTP header injection in misconfigured Nginx, OpenResty, and Tengine environments into request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The researchers said these browser-compatible attacks can enable XSS, account takeover, token and cookie theft, and cross-user compromise across sectors including CDN, telecom, payments, retail, streaming, and social platforms. Recommended mitigations included avoiding unsafe use of $uri or $document_uri in proxy_pass or return directives, reviewing upstream proxy configurations, and enabling HTTP/2 upstream where possible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Tom Stacey and Tobia Righi published research showing how CRLF/header injection in misconfigured Nginx-based deployments can be escalated into request smuggling, response queue poisoning, browser-powered desync, and self-propagating desync worms. The paper included multiple real-world case studies across CDN, telecom, payment, retail, streaming, social media, and account-management environments.
James Kettle of PortSwigger Research published the HTTP Terminator research describing an autonomous AI-assisted system for inventing, evaluating, and weaponizing novel HTTP desynchronization attacks against authorized live targets. The work reported new desync triggers, a dangling-byte weaponization technique, evidence of response forking, and the broader Shared Parser Confusion concept.
PortSwigger published the HTTP Terminator companion repository on GitHub, exposing the four-stage AI-assisted pipeline named seeker, flamer, validator, and investigator. The repository was presented as a reference companion to the research and excluded real target data and local SQLite databases.
Apache Traffic Server patched a zero-day desynchronization flaw that PortSwigger's research had uncovered using a trigger involving DELETE, Content-Location, Max-Forwards: 0, and a TRACE payload. The issue was tracked as CVE-2026-63078.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceportswigger.net
Open sourceportswigger.net
Open sourceportswigger.net
Open sourceportswigger.net
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers detailed a series of techniques that make web race conditions easier to trigger and more practical to exploit against real applications. PortSwigger's work showed that race conditions extend beyond simple limit-overrun bugs into broader application state-machine flaws, where carefully timed parallel requests can bypass business-logic checks and force inconsistent server behavior. A follow-on technique, the **single-packet attack**, reduced network jitter by coalescing multiple requests so they arrive together, effectively making remote race-condition testing behave more like a local attack and improving reliability against web targets. Flatt Security later expanded that approach with **First Sequence Sync**, a method that combines IP fragmentation and deliberate TCP sequence-number reordering to overcome the single-packet attack's approximate `65,535`-byte constraint. In testing, the technique synchronized much larger batches of requests over one HTTP/2 connection, reportedly sending `10,000` requests in about `166 ms` and demonstrating a bypass of a one-time-token rate limit by making `1,000` authentication attempts despite a nominal cap of five. The research indicates that exploitability depends on implementation details such as TCP receive-buffer capacity and HTTP/2 `SETTINGS_MAX_CONCURRENT_STREAMS`, but collectively the findings show that modern packet-level synchronization can significantly increase the impact and repeatability of web race-condition attacks.
Aug 1, 2026
CERT/CC disclosed **VU#885548**, a denial-of-service condition in some HTTP/2 server implementations that can be triggered remotely without authentication by abusing stalled flow-control behavior. An attacker can advertise settings such as `SETTINGS_INITIAL_WINDOW_SIZE = 0` or stop sending `WINDOW_UPDATE` frames, forcing servers to buffer large response bodies in memory across many concurrent streams. The resulting impact can include memory exhaustion, swap thrashing, worker or connection exhaustion, service instability, and in severe cases a full crash. Okta Red Team was credited with reporting the issue, and the advisory linked the problem to **`CVE-2026-59762`**, **`CVE-2026-59173`**, and **`CVE-2026-44909`**. F5 said **`CVE-2026-59762`** affects **BIG-IP** and related **BIG-IP Next** products when an HTTP/2 profile is configured on a virtual server, allowing crafted requests to drive up memory use in the **TMM** process until performance degrades or TMM restarts; the company rated the flaw **CVSS 7.5** under v3.1 and **8.7** under v4.0 and urged customers to install patched releases. Apache also confirmed **`CVE-2026-59173`** in **Apache Traffic Server** versions **9.0.0 through 9.2.13** and **10.0.0 through 10.1.2**, recommending upgrades to **9.2.14+** or **10.1.3+**. CERT noted that several vendors have already issued fixes, while some products including GNU wget, Go, HAProxy, ISC BIND, lighttpd, and nghttp2 were listed as not affected.
Jul 17, 2026
Multiple reports describe ways attackers or testers can **abuse trusted enterprise features** to evade controls. Researchers reported that *Palo Alto Networks Cortex XDR* **Live Terminal** can be repurposed as a stealthy **command-and-control (C2)** channel because its WebSocket-based protocol lacks command signing; an attacker who can intercept the initial WebSocket message can redirect an endpoint to an attacker-controlled server/tenant, leveraging the trusted `cortex-xdr-payload.exe` component to execute commands in a “living off the land” manner. Separately, a tutorial showed *Microsoft Defender for Cloud Apps* (reverse-proxy `*.mcas.ms`) download restrictions for unmanaged devices can be **bypassed by spoofing specific browser user-agent strings**, allowing direct access to services like Outlook/SharePoint and enabling successful downloads that would otherwise be blocked. Other material in the set covers adjacent but distinct execution and delivery risks rather than the same product-specific bypasses. **CVE-2026-27615** affects *ADB-Explorer* on Windows: allowing `ManualAdbPath` to be set to a **UNC path** in a settings file can lead to **remote code execution** by pointing the app to an attacker-controlled network share, fixed in Beta `0.9.26022`. Cofense also documented ongoing campaigns abusing **Windows File Explorer WebDAV** handling to deliver malware without a browser download flow, including use of `trycloudflare[.]com` tunnels to host WebDAV servers and multi-stage script chains to deliver RATs—highlighting a persistent social-engineering and delivery vector that can bypass some browser-centric controls.
Jun 29, 2026