Tag: http

On Friday, Xavier talked about the newly introduced HTTP Query method. This new method was introduced to allow „GET“ requests that include a body. The main reason for this was that GET requests typically do not contain a body. But what if they do?

HTTP QUERY Method: The Grey Zone Between GET and POST https://isc.sans.edu/diary/HTTP%20QUERY%20Method%3A%20The%20Grey%20Zone%20Between%20GET%20And%20POST./33352 Simple MacOS Docker Escape https://www.accomplish.ai/blog/escaping-dockers-hypervisor/ CVE-2026-77179 Brevo ClickFix Compromise https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up LastPass (and other) lookalike GitHub Repo and Kernel Module Infostealer https://blog.lastpass.com/posts/lastpass-delphos-report-rapuncel-infostealer My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

In June 2026 the IETF published RFC 10008[1], defining a new HTTP method: „QUERY“. The HTTP protocol faced already by changes (HTTP/2, HTTP/2) but it&#x27s the first new standard HTTP verb since „PATCH“ in 2010!

Comments

Comments

James Kettle of PortSwigger talks with the Dark Reading News Desk about his AI-powered open source tool, which found new HTTP request-smuggling techniques.

Comments

Comments

Comments

F5 schließt zwei kritische Speicherfehler im NGINX-Webserver, die Angreifern ohne Anmeldung Denial of Service und Codeausführung ermöglichen. Betroffen sind HTTP/3-Verarbeitung und HTTP/2-Proxying, bewertet mit CVSS von 9.2. Die außerplanmäßigen Patches kommen kurz nach NGINX Rift, dessen Rewrite-Lücke binnen Tagen nach Offenlegung ausgenutzt wurde.