AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
Read original article ↗AI Summary
PortSwigger researchers, led by James Kettle, used an AI-assisted system called HTTP Terminator to discover novel HTTP desynchronization techniques, including a new 'dangling-byte' method that improves the reliability of response queue poisoning (RQP) attacks. The system autonomously generated and validated 30,000 candidate attack vectors, identifying over 700 vulnerable targets across banks, government systems, and critical infrastructure. A human-guided follow-up revealed a zero-day in Apache Traffic Server, later patched and assigned CVE-2026-63078, while another concept, Shared-Parser Confusion, was proposed by the AI and validated by researchers.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.