Port Swigger at Black Hat & DEF CON 33
Summary: PortSwigger Research is returning to Black Hat USA and DEF CON 33 with talks arguing that request smuggling is an inherent flaw in the HTTP/1.1 protocol itself, six years after the firm first brought the issue to mainstream attention. Director of Research James Kettle will demonstrate how he compromised every customer of three major CDNs, exposing tens of millions of websites, and will present new classes of desync attacks plus a toolkit he used to earn over $200k in bug bounties in two weeks.
Why it matters: The claim is that mitigations for request smuggling have been ineffective or have made things worse, and that three major CDNs were each fully compromised across their entire customer bases - tens of millions of sites - so the exposure sits in shared infrastructure rather than in any single application your team controls.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026