Loading story…
PortSwigger researcher James Kettle said a large language model helped generate novel web attack ideas through an autonomous system called HTTP Terminator, which creates and tests tens of thousands of candidate HTTP desynchronization techniques. The system reportedly surfaced previously unconsidered desync methods, and Kettle described a workflow focused on validating machine-generated findings, filtering false positives, and using unexpected results to drive further research rather than treating AI as fully autonomous offensive tooling.
The work aligns with Kettle’s broader campaign against legacy HTTP parsing behavior, including his argument that HTTP/1.1 remains a root cause of request smuggling and desynchronization risk. By combining large-scale automated hypothesis generation with practical testing against HTTP parsing edge cases, the research highlights how AI can accelerate discovery of exploitable protocol ambiguities while reinforcing the need for defenders to reduce exposure to desync-prone architectures and outdated protocol handling.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
A Risky Business Features podcast episode discussed James Kettle's use of an autonomous system called the HTTP Terminator to generate and test tens of thousands of HTTP desynchronization techniques. The episode summary says the system had already found new desync methods Kettle had not previously considered.
w4ke.info published the article 'Funky chunks - addendum: a few more dirty tricks.' Based on the provided reference, this is a separate technical write-up related to the story and represents an additional public disclosure.
PortSwigger Research published the article 'HTTP/1.1 must die: the desync endgame,' documenting James Kettle's HTTP desynchronization research. The reference provides the publication date but no additional event details beyond the publication itself.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
risky.biz
Open sourcew4ke.info
Open sourceportswigger.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PortSwigger Research disclosed an AI-assisted system called **HTTP Terminator** that autonomously generated, tested, and weaponized novel HTTP desynchronization and request smuggling techniques against authorized live targets. The pipeline, published on GitHub as a multi-stage research framework, reportedly produced tens of thousands of candidate vectors from RFC-derived fragments and led to multiple real-world findings, including new desync triggers, a **dual-matching `Content-Length`** desync pattern, a **dangling-byte** weaponization method to improve response queue poisoning, and evidence of a possible new class dubbed **response forking**. The work also uncovered and helped patch **Apache Traffic Server** zero-day **`CVE-2026-63078`**, while exposing exploitable issues involving **F5 Big-IP**, **BeyondTrust Secure Remote Access**, **Citrix NetScaler**, and some **Azure Application Gateway** plus **Akamai** deployments. A related PortSwigger paper detailed **CRLF-powered desync attacks** that turn HTTP header injection in misconfigured **Nginx**, **OpenResty**, and **Tengine** environments into request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The researchers said these browser-compatible attacks can enable **XSS**, account takeover, token and cookie theft, and cross-user compromise across sectors including CDN, telecom, payments, retail, streaming, and social platforms. Recommended mitigations included avoiding unsafe use of **`$uri`** or **`$document_uri`** in `proxy_pass` or `return` directives, reviewing upstream proxy configurations, and enabling **HTTP/2 upstream** where possible.
Aug 13, 2026
New research and vendor advisories have highlighted a broader class of **HTTP desynchronization and request smuggling** risks driven by parser inconsistencies in headers and chunked encoding. A PortSwigger paper on **CRLF-powered desync attacks** warned that header injection can do far more than trigger open redirects or XSS, enabling attackers to "behead" HTTP streams and create severe front-end/back-end parsing mismatches. Related research on ambiguous chunk line terminators and chunk-extension parsing has shown how subtle differences in HTTP/1.1 handling can be turned into cache poisoning, security-control bypass, unauthorized access, and denial-of-service conditions. Red Hat documented multiple affected implementations under **CWE-444**. **`CVE-2026-33870`** in Netty was rated Important and stems from incorrect parsing of quoted strings in HTTP/1.1 chunked transfer-encoding extension values, with no acceptable mitigation listed beyond product fixes. **`CVE-2024-52304`** in aiohttp affects deployments using the pure Python parser, where newline handling in chunk extensions can let attackers bypass proxies or firewalls. **`CVE-2026-1525`** in Undici allows duplicate `Content-Length` headers through case-variant names, creating malformed requests that can trigger request smuggling or DoS. Supporting tooling such as **smugchunks** has emerged to detect chunk-parsing discrepancies in black-box testing, underscoring that these desync issues are practical and span multiple widely used HTTP stacks.
Aug 20, 2026
PortSwigger research warns that ambiguous HTTP/1.1 request boundaries continue to enable HTTP request-smuggling, or desynchronization, attacks across tens of millions of websites. The research introduced new desynchronization classes, reported critical exposure in major CDN infrastructure, and has been associated with compromises of three major CDNs and more than $350,000 in bug-bounty awards despite years of mitigations. One variant, **0.CL**, arises when a front end and back end disagree over a malformed or zero `Content-Length` header: the front end may forward a request without a body while the back end waits for one. Attackers can exploit an early-response endpoint to cause the back end to consume bytes from a following request, enabling queue poisoning and potentially cross-site scripting against another user. Organizations should eliminate HTTP/1.1 from proxy-to-origin paths where feasible by deploying HTTP/2 or later end to end, and continuously test any remaining HTTP/1.1 intermediaries for parser discrepancies.
Sep 3, 2026