AI-Driven HTTP Terminator Exposes Desync Tricks and Apache Zero-Day
PortSwigger's AI-assisted HTTP Terminator independently generated and validated new HTTP desynchronization techniques after testing 30,000 candidate vectors, including a dangling-byte method that stabilizes response queue poisoning; a human-guided cascade uncovered an Apache Traffic Server zero-day (CVE-2026-63078) with patch status unclear. The researchers scanned 30,000 authorized sites and found about 700 vulnerable targets—ranging from banks to government infrastructure—before deeper validation. They also reported a Shared-Parser Confusion concept and recommended mitigations such as avoiding HTTP/1.1 upstream or restricting bodies in allowed methods. The work highlights autonomous AI discovery with human input for the Apache bug and ongoing model evaluations.