importantSYS.SOURCE: The Hacker News• 2026-08-07T15:39:54+05:30

AI-Assisted HTTP Terminator Discovers New HTTP Desynchronization Techniques and Apache Zero-Day Vulnerability

#ai #vulnerability #http-desync #apache #web-security

An AI-assisted system called HTTP Terminator discovered novel HTTP desynchronization techniques and a zero-day vulnerability in Apache Traffic Server, including methods like 'dangling-byte' to exploit response queue poisoning. The research also introduced the 'Shared-Parser Confusion' attack concept, highlighting ongoing challenges in HTTP/1.1 security.

PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors.

PortSwigger said a separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server. Kettle said HTTP Terminator tested 30,000 websites where scanning

Read original article

*** END OF TRANSMISSION ***

> NEW MEXICO COURT ORDERS META TO PAY $567M IN CHILD SAFETY VIOLATION CASE > THE MISCONCEPTION OF TIME IN CLIMATE ACTION AND ITS IMPLICATIONS > MICROSOFT 365 AITM PHISHING CAMPAIGN TARGETS PAYROLL AND FINANCE EMAILS > US GOVERNMENT PAYS RWE $1.2B TO ABANDON OFFSHORE WIND PROJECTS UNDER TRUMP ADMINISTRATION > AI-ASSISTED HTTP TERMINATOR DISCOVERS NEW HTTP DESYNCHRONIZATION TECHNIQUES AND APACHE ZERO-DAY VULNERABILITY > NATJACK ATTACK EXPLOITS NAT TABLE MANIPULATION TO HIJACK TCP SESSIONS AND SPOOF DNS > MALWARE EXPLOITS WINDOWS HELLO FOR BUSINESS FOR PERSISTENT ENTRA ID ACCESS > VULNERABILITIES IN CLAUDE CODE AND GEMINI CLI ALLOW UNAUTHORIZED ACCESS TO CI SECRETS VIA GITHUB ISSUES > TEAMPCP'S LONG-TERM REDIS ATTACKS AND SUPPLY CHAIN CAMPAIGNS TRACED BACK TO 2020 > SUCCESSFUL COMPILATION OF NETSCAPE 3.0.2 ON 64-BIT DEBIAN SYSTEM> NEW MEXICO COURT ORDERS META TO PAY $567M IN CHILD SAFETY VIOLATION CASE > THE MISCONCEPTION OF TIME IN CLIMATE ACTION AND ITS IMPLICATIONS > MICROSOFT 365 AITM PHISHING CAMPAIGN TARGETS PAYROLL AND FINANCE EMAILS > US GOVERNMENT PAYS RWE $1.2B TO ABANDON OFFSHORE WIND PROJECTS UNDER TRUMP ADMINISTRATION > AI-ASSISTED HTTP TERMINATOR DISCOVERS NEW HTTP DESYNCHRONIZATION TECHNIQUES AND APACHE ZERO-DAY VULNERABILITY > NATJACK ATTACK EXPLOITS NAT TABLE MANIPULATION TO HIJACK TCP SESSIONS AND SPOOF DNS > MALWARE EXPLOITS WINDOWS HELLO FOR BUSINESS FOR PERSISTENT ENTRA ID ACCESS > VULNERABILITIES IN CLAUDE CODE AND GEMINI CLI ALLOW UNAUTHORIZED ACCESS TO CI SECRETS VIA GITHUB ISSUES > TEAMPCP'S LONG-TERM REDIS ATTACKS AND SUPPLY CHAIN CAMPAIGNS TRACED BACK TO 2020 > SUCCESSFUL COMPILATION OF NETSCAPE 3.0.2 ON 64-BIT DEBIAN SYSTEM