#HTTP2

Uvicorn now speaks HTTP/2 ⚡ - Opt in with uvicorn main:app --http zttp --http2 - Negotiated over TLS with ALPN, or cleartext with prior knowledge - Response trailers and 103 Early Hints

Ever wondered what “402 Payment Required” actually means? 👀 With x402 on @hedera, an AI agent can encounter a payment request, complete the payment as part of the HTTP flow, and access the requested resource. Here’s how the flow works 👇

1/ HTTP has a status code for payments that was never really used: 402 Payment Required x402 is an open standard that puts it to work A server asks for payment inside a normal request, and a client, like an AI agent, pays without a checkout page or an account... kinda genius

🚨 PHP releases new Windows builds to fix critical HTTP2Shell vulnerability The PHP team has rebuilt its supported Windows packages with Brotli 1.2.1, addressing CVE-2026-111497, an out-of-bounds write flaw that can potentially lead to remote code execution. ⠀ In PHP’s Windows builds, the vulnerable Brotli decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This cURL feature is disabled by default, but applications and HTTP client libraries can turn it on. ⠀ Updated builds: • PHP 8.5.12-1 • PHP 8.4.27-1 • PHP 8.3.36-1 • PHP 8.2.35-1 ⠀ The “-1” suffix indicates that the Windows packages were rebuilt with updated dependencies. The PHP source and runtime version numbers remain unchanged. This is separate from the PHP2Shell flaws patched on October 21.

Looking to test APIs and download files directly from the Linux terminal? This guide covers 8 command-line HTTP clients that help you send HTTP requests, inspect response headers, debug APIs, and work with JSON responses without leaving your terminal. Explore tools like curl, HTTPie, Hurl, and Posting to find the right client for your workflow. 📖 Read here: 👉 Follow @tecmint for daily #Linux, #LinuxTips, #HTTP, #API, #APItesting, #CommandLine, #DevOps, #SysAdmin, and #TechTips

🚨 𝗛𝗘𝗥𝗠𝗘𝗦 𝗠𝗢𝗕𝗜𝗟𝗘 𝗕𝗘𝗧𝗔 — 𝗦𝗘𝗟𝗙-𝗛𝗢𝗦𝗧𝗘𝗗 𝗦𝗘𝗧𝗨𝗣 𝗚𝗨𝗜𝗗𝗘! 📱🔥 I've spent over a DECADE in systems engineering, and somehow getting the new Hermes Mobile Beta connected to my own self-hosted @NousResearch Hermes Agent still gave me a little trouble! 😂 So here's a quick guide to save everyone else the headache! ━━━━━━━━━━━━━━━━━━━━ 🖥️ 𝗦𝗧𝗘𝗣 𝟭 — 𝗦𝗧𝗔𝗥𝗧 𝗧𝗛𝗘 𝗗𝗔𝗦𝗛𝗕𝗢𝗔𝗥𝗗 On the machine running Hermes: hermes dashboard --host 0.0.0.0 --port 9119 --no-open On first interactive setup, Hermes can prompt you to create a username and password. SAVE THOSE! 🔒 𝗣𝗥𝗘𝗙𝗘𝗥 𝗧𝗔𝗜𝗟𝗦𝗖𝗔𝗟𝗘? (Recommended) Bind directly to your machine's Tailscale IP instead: hermes dashboard --host 100.x.x.x --port 9119 --no-open ━━━━━━━━━━━━━━━━━━━━ 📱 𝗦𝗧𝗘𝗣 𝟮 — 𝗚𝗥𝗔𝗕 𝗧𝗛𝗘 𝗕𝗘𝗧𝗔 ⚙️ 𝗦𝗧𝗘𝗣 𝟯 — 𝗦𝗘𝗟𝗘𝗖𝗧 𝗦𝗘𝗟𝗙-𝗛𝗢𝗦𝗧𝗘𝗗 NOT Nous Portal! You're connecting to your OWN Hermes instance. 🌐 𝗦𝗧𝗘𝗣 𝟰 — 𝗘𝗡𝗧𝗘𝗥 𝗬𝗢𝗨𝗥 𝗚𝗔𝗧𝗘𝗪𝗔𝗬 𝗨𝗥𝗟 🏠 Home Wi-Fi: http://192.168.x.x:9119 🔐 Tailscale: http://100.x.x.x:9119 Replace the example IP with your Hermes machine's actual address. 🔑 𝗦𝗧𝗘𝗣 𝟱 — 𝗘𝗡𝗧𝗘𝗥 𝗬𝗢𝗨𝗥 𝗖𝗥𝗘𝗗𝗘𝗡𝗧𝗜𝗔𝗟𝗦 Use the dashboard username and password you configured earlier. ✅ 𝗦𝗧𝗘𝗣 𝟲 — 𝗧𝗔𝗣 𝗖𝗢𝗡𝗡𝗘𝗖𝗧! That's it. Your self-hosted Hermes Agent, accessible from your phone! 🙌 ━━━━━━━━━━━━━━━━━━━━ 💡 𝗧𝗪𝗢 𝗜𝗠𝗣𝗢𝗥𝗧𝗔𝗡𝗧 𝗧𝗜𝗣𝗦: • Your phone must be on the same reachable network or connected through Tailscale. • Never expose port 9119 directly to the public internet with basic password authentication. I recommend Tailscale! Hopefully this saves someone else the troubleshooting session I went through! 😂 Enjoy Hermes Mobile! 📱💚 This thing packs a punch and even connects to your Hermes desktop sessions, something I’ve been in DESPERATE need of!! 🔥

Why cleartext HTTP is a security nightmare 🕵️‍♂️🔒 Quick tutorial at how network protocols handle data if it isn’t encrypted with SSL/TLS • 127.0.0.1 •

We made a website to check if your http client is vulnerable to CVE-2026-111497 (Node2Shell/HTTP2Shell) Also open-source: Some examples:

【HTTP2Shell、何を確かめれば「対応した」と言える？】 正体はHTTP/2の欠陥ではなく、データを小さくする部品Brotliの、展開部分の不具合です。 更新したら、再起動まで。アプリ内蔵やコンテナに残るコピー、版の表示だけでは判断できない理由も、公式情報をもとに整理しました。 AIの「対応しました」は、未確認と残課題の欄まで読んでから、なと。

🚨 Brotli2Shell goes beyond HTTP2Shell. CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP. JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing. We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions. Full research and technical details in our blog 👇

Bug bounty has definitely changed. I used to spend hours analyzing HTTP requests, switching back and forth between Firefox and Burp Suite. Now, I open my terminal, point my AI skills at a target, intercept and analyze HTTP traffic using Burp Suite MCP, and offload heavy tasks to my HackBot running on a VPS. But here’s the thing: AI doesn’t replace your hacking skills. It scales them. The goal is to get really good at manual hacking first, then use AI to automate and scale what you already know. Not the other way around. You don’t start by building a HackBot and expecting it to hack for you when you don’t even understand what it’s doing. Learn to hack first. Automate second. Scale third. Keep hacking! ✌️

An introduction to how #HTTP2 works

🔴 İddiaya göre PHP2Shell'in başarılı olduğu testler genellikle tek worker'lı Apache mod_php, yamalanmamış PHP, 128 MiB bellek sınırı, düz HTTP/80 kullanan honeypotlardan oluşuyor. Araştırmacılar kasıtlı olarak saldırıya elverişli php yapılandırması bırakıyorlar, diğer yapılandırmalarda ise başarı oranı henüz ölçülmedi.

As of this morning, supports HTTP/2. Tested by #http2 #webperf

Introducing IP Shield on PARANOID. Your IP address can give away your city, your home and, through your internet provider, your name. Until now it traveled with every question you asked. Turn on IP Shield and the server that reads your questions never sees your IP address, so what you ask can no longer be traced back to where you are. How is that possible? Your browser does the work before anything leaves your computer. When you ask a question, your browser takes PARANOID’s public key and seals the entire request with HPKE, the modern encryption standard that pairs an X25519 key exchange with AES-GCM. Every question gets a brand new one-time key, so even two questions from the same person look like strangers to each other. The sealed request goes to a relay first. The relay sees your IP address next to a block of bytes it cannot read, and it passes those bytes on under its own address. Only PARANOID’s private key can open them, and inside it finds your question with the relay’s address on it instead of yours. The answer travels back the same way, sealed with a key that only your browser holds, so the relay never reads that either. This is Oblivious HTTP, the IETF standard published as RFC 9458. It is the same design that sits in front of Apple’s Private Cloud Compute and Chrome’s Safe Browsing checks, and now it sits in front of your AI chats. It is one switch above the chat, with nothing to install. Live today at

Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.

【緊急セキュリティ情報】PHP2Shell、実際のリモートコード実行（RCE）に成功した証拠を確認 2026年10月24日、セキュリティ研究者Adel Karimi氏が運用するハニーポットで、PHP2Shellを悪用した35回のシェル起動が確認されました。 対象はPHP 8.4.26を使用するApache mod_php環境です。 今回重要なのは、ネットワークパケットとLinuxのプロセス監視記録を照合し、Apacheのワーカープロセスから実際に35回のシェルが起動されたことが確認されています。攻撃では、メモリ情報漏洩によってASLR（アドレス空間配置のランダム化）を回避し、リモートコード実行に至ったと分析されています。 さらに、米国CISAは10月26日、PHP2Shellの2件の脆弱性をKEVカタログに追加しました。 対象： ・CVE-2026-109618 ・CVE-2026-109619 企業が今すぐ実施すべきことは、パッチ適用前に侵害されていなかったか、Apacheのプロセス起動履歴、HTTPアクセスログ、PHPのメモリエラーなどを調査する必要があります。 今回の事例は、PHP2Shellが実際に悪用可能な脆弱性であることを示しています。 サイバー防御は、脆弱性を修正するだけでなく、侵害の痕跡を検証する段階に入っています。

A researcher's PHP2Shell honeypots recorded 35 shells started by Apache workers on 24 October, all on PHP 8.4.26, from two source IPs. Marcus Hutchins called it the highest quality confirmation of in-the-wild exploitation he has seen so far.

For a new blogpost, I'm trying to create the Ultimate #HTTP3 vs #HTTP2 protocol stack image to Rule Them All™. Would love to get some feedback on clarity/missing aspects and (God forbid) correctness.

Closing out #php2shell: a universal black-box PoC for PHP's session upload-progress bug. One pure-HTTP chain - arm the allocator, spray fake refs, leak the heap, beat ASLR, turn a destructor into system(). Verified blind on Debian 13 PHP 8.4.24, x86-64 + arm64: RCE as www-data.

【來打丁 ... 😱】PHP 再傳出 CVSS 危險評級達 9.2 分的重大安全威脅。不過這次它也是受害者，事緣 PHP 的 Windows 版本內建 Brotli 壓縮程式庫存在重大安全漏洞（漏洞編號：CVE-2026-111497），可讓遠端攻擊者執行任意程式碼，官方強烈呼籲受影響的伺服器管理員與開發團隊立即安裝修補程式。 據官方發布的安全公告，本次修復的核心為編號 CVE-2026-111497 的重大漏洞。該問題源於 Google 開源的 Brotli 壓縮／解壓縮核心套件，主要涉及越界寫入與堆疊記憶體毀損（Heap Memory Corruption）缺陷。 當後端應用程式透過 cURL、Guzzle 或內建解壓縮模組處理特製的惡意壓縮 HTTP 回應或數據封包時，攻擊者便可觸發該漏洞造成記憶體錯亂，不僅可能導致伺服器程序異常崩潰，嚴重時更可在未經身分驗證的情況下獲取遠端程式碼執行權限（RCE），其 CVSS 危險評級因而高達 9.2 分。 PHP 官方指出，針對 Windows 平台提供的預先編譯版本（PHP 8.2 至 8.5 相關組建版本），由於直接封裝了存在缺陷的 Brotli 函式庫，因此風險最為直接。官方已於 10 月 26 日全面推送更新後的 Windows 安裝建置版本以作替換。 在 Linux 作業系統環境方面，雖然 PHP 本身多數依賴作業系統底層的共用套件庫，但若系統本身安裝的 libbrotli 相依套件尚未修正，伺服器依然會暴露於潛在攻擊風險之中。 因此，Linux 環境管理者除檢視 PHP 設定外，亦須透過所屬發行版的套件管理工具（如 APT、YUM 或 DNF）獨立更新底層的 Brotli 相關相依函式庫。

Which HTTP method is generally used to retrieve data without modifying it? A. POST B. GET C. PUT D. PATCH