News Summary

• PortSwigger says its AI-assisted research system generated and proved new HTTP desynchronization techniques.
• The research produced new desync triggers, a dual-matching Content-Length pattern, and a "dangling-byte" technique designed to make response queue poisoning (RQP) more reliable.
• PortSwigger said a separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server.
• The researchers also disclosed Shared-Parser Confusion, a broader attack concept that the system proposed but Kettle validated.