HTTP/1.1 must die: Dafydd Stuttard on what this means for enterprise security
Summary: At Black Hat USA 2025 and DEF CON 33, PortSwigger Director of Research James Kettle presented new HTTP desync techniques, and CEO Dafydd Stuttard told security leaders that any HTTP/1.1 hop in a stack should be treated as vulnerable. HTTP/1.1 still carries around half of internet traffic, and many services advertising HTTP/2 support downgrade to HTTP/1.1 internally, including within third-party CDN infrastructure that customers may not be able to reconfigure.
What's compelling: Kettle and his collaborators collected over $350k in bug bounties after compromising virtually every customer of several major CDNs, roughly 30 million websites, which shows the exposure sits in vendor-managed hops that enterprises assume are secure by default.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026