CAN AI DO NOVEL SECURITY RESEARCH? MEET THE HTTP TERMINATOR

Summary from the TLDR InfoSec newsletter

PortSwigger built HTTP Terminator to generate and test HTTP desync hypotheses on 30,000 authorized targets. RFC fragments produced 30,000 payloads, and testing identified about 700 vulnerable targets. Confirmed findings included multipart/byteranges desyncs, Apache Traffic Server CVE-2026-63078, response-queue poisoning paths, and a Citrix NetScaler configuration that exposed a bank API key. Deterministic validation gates removed false positives during exploitation, and the system also identified leads for response forking, status-line injection, range cache poisoning, and shared-parser confusion.