🎯 HTTP request smuggling

The items that name it 5

• The Era of Software Quality, or the Era of Ostriches?
  article2026-10-05

  Request parsing bugs in SoupServer that caused it to be removed from bug bounty scope; described as posing no threat to GNOME users

• watchTowr: CVE-2026-88771 Citrix NetScaler ADC/Gateway unauthenticated RCE
  advisory2026-09-27

  Among the six further NetScaler vulnerabilities (CVE-2026-88773 to CVE-2026-88778) fixed in the same bulletin, dependent on specific configurations

• [tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026
  article2026-09-24It is written here as HTTP request smuggling (CL.TE desync).

  Injected Transfer-Encoding header turns header injection into a CL.TE desync, extended into a self-replicating worm

• https://github.com/akha-security/akca
  repo2026-09-23It is written here as HTTP request smuggling (CL.TE and TE.CL).

  CL.TE and TE.CL

• PortSwigger/http-terminator
  repo

  Attack technique the pipeline is designed to discover and exploit