New variants of the HTTP request smuggling attack method impacted several widely used content delivery networks, major organizations, and millions of websites. James Kettle, director of research at application security firm PortSwigger, presented a new attack method on Wednesday at the Black Hat conference. Kettle has worked with several others, including a team of bug bounty hunters, to find impacted organizations and inform them about the risks. HTTP request smuggling, also referred to as a desync attack, leverages inconsistencies in how web servers process HTTP requests, enabling an attacker to ‘smuggle’ a malicious request inside a legitimate one. The issue is related to how servers — typically frontend servers that act as load balancers or proxies, and backend servers that host a…