"The entire internet is broken": ethical hacking expert John Hammond meets James Kettle
Summary: PortSwigger researcher James Kettle presented new classes of HTTP desync attack in a video with ethical hacker John Hammond, demonstrating critical vulnerabilities affecting tens of millions of websites, including core infrastructure within major CDNs. The research holds that HTTP/1.1's fatal flaw is ambiguity about where one request ends and the next begins, and that vendors' mitigations over six years have been bypassed repeatedly, while HTTP/2 makes desync attacks virtually impossible if used for the upstream connection between reverse proxies and origin servers.
What you should know: Tens of millions of websites, including core infrastructure inside major CDNs, are exposed to hostile takeover through a protocol flaw that six years of vendor mitigations have failed to close.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026