HTTP Terminator finds new web attacks across 30,000 tests

What this is about

On August 5, 2026, PortSwigger security researcher James Kettle presented HTTP Terminator. The system combined language models with specialized testing tools to develop new HTTP desynchronization attacks and test them on websites whose programs explicitly authorized such testing. It started with 138 technical standards, split them into 15,000 small fragments, and derived 30,000 potential attack vectors after removing duplicates.

The tests ran against 30,000 websites with a strict limit of less than one request per second per domain. According to Kettle's research report, roughly 700 vulnerable targets remained after automated evaluation. They included banks, government infrastructure, security products, and an airport.

What HTTP Terminator actually does

HTTP desynchronization happens when two servers in a chain interpret the same request differently. A front-end proxy may think a request has ended while the back-end server is still waiting for more data. Attackers can use that mismatch to mix part of their request with the next user's request.

HTTP Terminator automates four stages: it generates hypotheses, evaluates them, tries to turn confirmed effects into a practical security proof, and uses successful findings as fuel for more variants. One newly identified approach using the official multipart/byteranges content type worked against more than 200 websites in the test set, according to the independent summary by The Hacker News. Another technique intentionally leaves a smuggled request one byte short. A victim's request then supplies that byte and can make an otherwise unreliable attack more reproducible.

The source code is public on GitHub. The released implementation uses Claude for document extraction and test-case generation, and Claude Code during an investigator stage. However, PortSwigger does not identify the exact model and model version behind every individual discovery.

Why it matters

The work demonstrates more than faster vulnerability scanning. According to the researcher, the system generated and proved several new techniques autonomously. That shifts the boundary between automated checks for known bugs and the development of previously unknown attack ideas. For operators of large web platforms, it means rare protocol discrepancies can now be examined at a scale that one person could hardly manage alone.

Humans still remained essential. The broader attack class called Shared-Parser Confusion emerged only through collaboration between the system and the researcher. A zero-day flaw in Apache Traffic Server was also confirmed in a human-guided research cascade. PortSwigger says it has been patched and assigns CVE-2026-63078. On August 7, however, The Hacker News could not find a matching public record at CVE.org, NVD, or in the available Apache advisory. Defenders therefore could not yet determine from public records which specific version contains the fix.

In plain language

Imagine a parcel station with two workers. The first reads “parcel complete” and passes the box on. Because the second interprets the label differently, they think something is missing and add an item from the next customer's parcel. HTTP desynchronization exploits that disagreement. HTTP Terminator systematically tries thousands of unusual labels and records which combinations make the two stations lose alignment.

A practical example

A retailer runs a proxy in front of its web server and permits security testing through a bug-bounty program. HTTP Terminator generates 30,000 unusual request variants, limits testing to less than one request per second, and discards every variant that produces no measurable difference. For one variant, the proxy responds normally while the web server waits for one more byte.

The researchers repeat the test in an isolated session and show that a second authorized test request enters the wrong response queue. The retailer can then restrict unknown methods and replace HTTP/1.1 between the proxy and back end. Crucially, testing third-party systems this way without explicit authorization would be neither responsible nor lawful.

Scope and limits

• The published figures mainly come from the system's developer. There is no public independent reproduction of all 30,000 vectors and roughly 700 targets.
• The exact contribution of individual models is not fully traceable because the model and version are not mapped to each finding. The results therefore do not prove a general, model-independent research breakthrough.
• At publication time, the Apache case had a public evidence gap: PortSwigger named a patch and CVE, but a clearly attributable vendor advisory listing affected and fixed versions was not available on August 7.
• Automated attack testing must only target systems you own or targets with explicit authorization. Rate limits do not replace legal permission.

For defense, PortSwigger recommends avoiding HTTP/1.1 on upstream connections where possible. Where that is not possible, the proxy and back end should use the same allow-list of HTTP methods and clearly restrict which methods may carry a request body.

SEO & GEO keywords

HTTP Terminator, PortSwigger, James Kettle, HTTP desync, request smuggling, Apache Traffic Server, CVE-2026-63078, AI security research, web security, bug bounty, Shared-Parser Confusion