HTTP headers are a new vector for prompt injection attacks
Research shows 30 sites used HTTP response headers to inject instructions into AI agents, bypassing standard page-level defenses.
Results for “http”
Daily coverage of AI, developer tools and infrastructure. Each story explains what happened and why it matters, with a link to the original source.
Go 1.27 fixes HTTP/1 connection reuse for unread response bodies
Go 1.27 improves HTTP/1 client performance by automatically handling unread response bodies, enabling connection reuse without manual code changes.
curl fixes high-severity HTTP/2 upload flaw enabling client-side code execution
curl 8.23.0 patches CVE-2026-92392, a use-after-free vulnerability in HTTP/2 uploads that allows malicious servers to execute code on clients.
Rejetto HFS flaw allows admin takeover via weak random numbers
Attackers are exploiting CVE-2026-61500 in Rejetto HTTP File Server to forge admin sessions and execute code. The bug stems from a predictable pseudo-random number generator.
