#http-request-smuggling

Analysis · May 8, 2026 · Colten Anderson

Qlik patched the smuggling bug, then Praetorian beat it with one extra letter

On August 29, 2023, Qlik shipped a literal-string filter for chunked transfer encoding. Three weeks later Praetorian sent tchunked, the desync came back, and Cactus ransomware spent the next two months harvesting the administrators who thought they were done patching.