ネスペだけど、『HTTP1,2,3の違い何？』答えられずマスタリングTCPIP読み返したら、1ページしか割かれていなかった。
HTTP3はQUIC通信（UDP活用)なのでは？の推測は合ってた。Web屋さんでないので、HTTP2は1と違いがあんまりはっきりとわからぬ…
HTTP3はQUIC通信（UDP活用)なのでは？の推測は合ってた。Web屋さんでないので、HTTP2は1と違いがあんまりはっきりとわからぬ…
November 7, 2026 at 2:14 PM
ネスペだけど、『HTTP1,2,3の違い何？』答えられずマスタリングTCPIP読み返したら、1ページしか割かれていなかった。
HTTP3はQUIC通信（UDP活用)なのでは？の推測は合ってた。Web屋さんでないので、HTTP2は1と違いがあんまりはっきりとわからぬ…
HTTP3はQUIC通信（UDP活用)なのでは？の推測は合ってた。Web屋さんでないので、HTTP2は1と違いがあんまりはっきりとわからぬ…
Updated: Debug HTTP/3 QUIC in Production: 8-Step Playbook
A Wireshark-free workflow to prove HTTP/3 is actually negotiated, diagnose silent…
#http3 #quic
https://www.kunalganglani.com/blog/debug-http3-quic-production?utm_source=bluesky&utm_medium=update&utm_campaign=debug-http3-quic-production
A Wireshark-free workflow to prove HTTP/3 is actually negotiated, diagnose silent…
#http3 #quic
https://www.kunalganglani.com/blog/debug-http3-quic-production?utm_source=bluesky&utm_medium=update&utm_campaign=debug-http3-quic-production
Debug HTTP/3 QUIC in Production: 8-Step Playbook
A Wireshark-free workflow to prove HTTP/3 is actually negotiated, diagnose silent fallback to HTTP/2, and measure real perf impact using DevTools, curl, and logs.
www.kunalganglani.com
November 2, 2026 at 12:53 AM
Updated: Debug HTTP/3 QUIC in Production: 8-Step Playbook
A Wireshark-free workflow to prove HTTP/3 is actually negotiated, diagnose silent…
#http3 #quic
https://www.kunalganglani.com/blog/debug-http3-quic-production?utm_source=bluesky&utm_medium=update&utm_campaign=debug-http3-quic-production
A Wireshark-free workflow to prove HTTP/3 is actually negotiated, diagnose silent…
#http3 #quic
https://www.kunalganglani.com/blog/debug-http3-quic-production?utm_source=bluesky&utm_medium=update&utm_campaign=debug-http3-quic-production
RT @HSVSphere: what does it do that quic/http3 doesn't
November 1, 2026 at 6:29 AM
RT @HSVSphere: what does it do that quic/http3 doesn't
HTTP/2 and HTTP/3: Do They Matter for SEO and Speed?
#SiteSEOAIAudit #AISearch #GEO #KeywordResearch
https://siteseoaiaudit.com/http2-http3-seo/
#SiteSEOAIAudit #AISearch #GEO #KeywordResearch
https://siteseoaiaudit.com/http2-http3-seo/
HTTP/2 and HTTP/3: Do They Matter for SEO and Speed?
#SiteSEOAIAudit #AISearch #GEO #KeywordResearch
siteseoaiaudit.com
October 29, 2026 at 6:02 AM
HTTP/2 and HTTP/3: Do They Matter for SEO and Speed?
#SiteSEOAIAudit #AISearch #GEO #KeywordResearch
https://siteseoaiaudit.com/http2-http3-seo/
#SiteSEOAIAudit #AISearch #GEO #KeywordResearch
https://siteseoaiaudit.com/http2-http3-seo/
1/2
Detect POP regressions before users notice: run tiny synthetic probes from each POP that mirror a real init+first-chunk.
Keep them cheap:
• 1–2s chunk fetch + init manifest
• Measure: TTFB, first-chunk bytes, TLS/HTTP3 success, and decode sanity
Detect POP regressions before users notice: run tiny synthetic probes from each POP that mirror a real init+first-chunk.
Keep them cheap:
• 1–2s chunk fetch + init manifest
• Measure: TTFB, first-chunk bytes, TLS/HTTP3 success, and decode sanity
October 30, 2026 at 6:57 AM
1/2
Detect POP regressions before users notice: run tiny synthetic probes from each POP that mirror a real init+first-chunk.
Keep them cheap:
• 1–2s chunk fetch + init manifest
• Measure: TTFB, first-chunk bytes, TLS/HTTP3 success, and decode sanity
Detect POP regressions before users notice: run tiny synthetic probes from each POP that mirror a real init+first-chunk.
Keep them cheap:
• 1–2s chunk fetch + init manifest
• Measure: TTFB, first-chunk bytes, TLS/HTTP3 success, and decode sanity
1/2
Detect POP regressions before users notice: run tiny synthetic probes from each POP that mirror a real init+first-chunk.
Keep them cheap:
• 1–2s chunk fetch + init manifest
• Measure: TTFB, first-chunk bytes, TLS/HTTP3 success, and decode sanity
Detect POP regressions before users notice: run tiny synthetic probes from each POP that mirror a real init+first-chunk.
Keep them cheap:
• 1–2s chunk fetch + init manifest
• Measure: TTFB, first-chunk bytes, TLS/HTTP3 success, and decode sanity
October 30, 2026 at 6:57 AM
1/2
Detect POP regressions before users notice: run tiny synthetic probes from each POP that mirror a real init+first-chunk.
Keep them cheap:
• 1–2s chunk fetch + init manifest
• Measure: TTFB, first-chunk bytes, TLS/HTTP3 success, and decode sanity
Detect POP regressions before users notice: run tiny synthetic probes from each POP that mirror a real init+first-chunk.
Keep them cheap:
• 1–2s chunk fetch + init manifest
• Measure: TTFB, first-chunk bytes, TLS/HTTP3 success, and decode sanity
HTTP3もHOLブロッキング解消のためにUDPの上で実装されている位しか把握していないのでこれを機に抑えなければ、資格試験、なんとなくの理解を深めてくれるから良い
October 27, 2026 at 4:22 AM
HTTP3もHOLブロッキング解消のためにUDPの上で実装されている位しか把握していないのでこれを機に抑えなければ、資格試験、なんとなくの理解を深めてくれるから良い
📌 SANS Stormcast Highlights HTTP/3 Challenges, Android and Oracle Patches, and Malicious JetBrains Plu... https://www.cyberhub.blog/article/27149-sans-stormcast-highlights-http3-challenges-android-and-oracle-patches-and-malicious-jetbrains-plugins
SANS Stormcast Highlights HTTP/3 Challenges, Android and Oracle Patches, and Malicious JetBrains Plugins
The June 18, 2026, SANS Internet Storm Center Stormcast covered HTTP/3 (QUIC), a UDP-based encrypted protocol now accounting for 30% of web traffic, supported by major browsers and servers. Traditional TLS inspection tools fail with HTTP/3 due to its encryption and proxy-blind nature, requiring organizations to block outbound UDP traffic beyond just port 443, as QUIC can operate on any port and supports services like SMB and DNS-over-QUIC. Detection may involve filtering HTTPS DNS records advertising QUIC support. Google’s Android 17 update patched 21 vulnerabilities, aligning with the July 1 patch level, while Oracle’s monthly Critical Security Patch Update addressed 245 flaws, notably in Fusion Middleware. Additionally, malicious JetBrains IDE plugins were discovered stealing AI API keys by exfiltrating them via HTTP to attacker-controlled IP addresses. The episode noted no podcast on June 19 due to the Juneteenth holiday.
www.cyberhub.blog
October 29, 2026 at 12:07 AM
📌 SANS Stormcast Highlights HTTP/3 Challenges, Android and Oracle Patches, and Malicious JetBrains Plu... https://www.cyberhub.blog/article/27149-sans-stormcast-highlights-http3-challenges-android-and-oracle-patches-and-malicious-jetbrains-plugins
📌 Use-after-free vulnerability in nginx HTTP/3 QPACK encoder (CVE-2026-42530) https://www.cyberhub.blog/article/27355-use-after-free-vulnerability-in-nginx-http3-qpack-encoder-cve-2026-42530
Use-after-free vulnerability in nginx HTTP/3 QPACK encoder (CVE-2026-42530)
The post references a vulnerability identified as CVE-2026-42530, which involves a use-after-free flaw in the QPACK encoder component of nginx when using HTTP/3. The issue is documented in an external research link provided in the post. No additional technical details or affected versions are explicitly stated in the post.
www.cyberhub.blog
October 27, 2026 at 5:07 PM
📌 Use-after-free vulnerability in nginx HTTP/3 QPACK encoder (CVE-2026-42530) https://www.cyberhub.blog/article/27355-use-after-free-vulnerability-in-nginx-http3-qpack-encoder-cve-2026-42530
wait what's this about http3 and pingcap
October 21, 2026 at 11:14 PM
wait what's this about http3 and pingcap
So just to summarize we’ve got:
- eMudhra keys leaked (“4”)
- RCE in PHP since 2012
- RCE in gitlab since 2016
- Java CVE (probably eMudhra)
- HTTP3 compression bomb
- PingCAP just utterly beyond 0wned
Anything else?
- eMudhra keys leaked (“4”)
- RCE in PHP since 2012
- RCE in gitlab since 2016
- Java CVE (probably eMudhra)
- HTTP3 compression bomb
- PingCAP just utterly beyond 0wned
Anything else?
October 21, 2026 at 11:12 PM
So just to summarize we’ve got:
- eMudhra keys leaked (“4”)
- RCE in PHP since 2012
- RCE in gitlab since 2016
- Java CVE (probably eMudhra)
- HTTP3 compression bomb
- PingCAP just utterly beyond 0wned
Anything else?
- eMudhra keys leaked (“4”)
- RCE in PHP since 2012
- RCE in gitlab since 2016
- Java CVE (probably eMudhra)
- HTTP3 compression bomb
- PingCAP just utterly beyond 0wned
Anything else?
(6) is not about QUIC, it's about HTTP3 header compression (QPACK).
Just an FYI for anyone who's doing QUIC via iroh.
Just an FYI for anyone who's doing QUIC via iroh.
so what has broken the internet today? well,
1. php
2. node.js
3. gitlab
4. 4
5. musl
6. QUIC/HTTP/3
7. Signal
8. Apache Traffic Server
9. Pillow for Python, even!
10. bind
11. LiteLLM
12. XZ Utils
13. Bind
(Java is reported, but supposedly it's just their version of the 4 issue)
1. php
2. node.js
3. gitlab
4. 4
5. musl
6. QUIC/HTTP/3
7. Signal
8. Apache Traffic Server
9. Pillow for Python, even!
10. bind
11. LiteLLM
12. XZ Utils
13. Bind
(Java is reported, but supposedly it's just their version of the 4 issue)
October 22, 2026 at 1:02 PM
(6) is not about QUIC, it's about HTTP3 header compression (QPACK).
Just an FYI for anyone who's doing QUIC via iroh.
Just an FYI for anyone who's doing QUIC via iroh.
aww she doesn't know http3 got cve'd too
October 21, 2026 at 11:46 PM
aww she doesn't know http3 got cve'd too
Anyway did any new megaCVEs drop while I was asleep other than the other new ones I've already seen (http3, gitlab) lol
October 22, 2026 at 5:45 AM
Anyway did any new megaCVEs drop while I was asleep other than the other new ones I've already seen (http3, gitlab) lol
HTTP3 compression bomb (includes h3 cause it’s not a memory safety vulnerability, just a reliable OOM crash) bsky.app/profile/xeia...
October 21, 2026 at 11:23 PM
HTTP3 compression bomb (includes h3 cause it’s not a memory safety vulnerability, just a reliable OOM crash) bsky.app/profile/xeia...
they also apparently havent patched the http3/quic bug even though it was reported in may
October 22, 2026 at 6:50 AM
they also apparently havent patched the http3/quic bug even though it was reported in may
this is a bit of a jump scare after a long... day... but the timeline on this was almost a year and many things are patched.
in particular, the PDS reference distro uses caddy (with QUIC HTTP3). but it self-updates and has been patched for some time.
if you run caddy for other stuff, update it
in particular, the PDS reference distro uses caddy (with QUIC HTTP3). but it self-updates and has been patched for some time.
if you run caddy for other stuff, update it
October 22, 2026 at 2:48 AM
this is a bit of a jump scare after a long... day... but the timeline on this was almost a year and many things are patched.
in particular, the PDS reference distro uses caddy (with QUIC HTTP3). but it self-updates and has been patched for some time.
if you run caddy for other stuff, update it
in particular, the PDS reference distro uses caddy (with QUIC HTTP3). but it self-updates and has been patched for some time.
if you run caddy for other stuff, update it
Wait, what's this about HTTP3?
October 22, 2026 at 12:42 PM
Wait, what's this about HTTP3?
there’s an http3? and it’s horribly insecure?
October 21, 2026 at 11:23 PM
there’s an http3? and it’s horribly insecure?
you can check if a service is doing HTTP/3 with:
curl --http3-only pds.example.com -vvv
if this prints periodic failures, the server isn't really doing HTTP/3.
curl --http3-only pds.example.com -vvv
if this prints periodic failures, the server isn't really doing HTTP/3.
October 22, 2026 at 2:48 AM
you can check if a service is doing HTTP/3 with:
curl --http3-only pds.example.com -vvv
if this prints periodic failures, the server isn't really doing HTTP/3.
curl --http3-only pds.example.com -vvv
if this prints periodic failures, the server isn't really doing HTTP/3.
sorry folks, one more before you “go to sleep”
a vulnerability in QUIC/HTTP3 can cause a server to crash with a single request
foxio.io/blog/header-...
a vulnerability in QUIC/HTTP3 can cause a server to crash with a single request
foxio.io/blog/header-...
Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation
We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.
foxio.io
October 21, 2026 at 11:49 PM
sorry folks, one more before you “go to sleep”
a vulnerability in QUIC/HTTP3 can cause a server to crash with a single request
foxio.io/blog/header-...
a vulnerability in QUIC/HTTP3 can cause a server to crash with a single request
foxio.io/blog/header-...
okay so what broke with http3?
October 22, 2026 at 6:26 AM
okay so what broke with http3?
Tiny HTTP/3 header batches can trigger 4,000× memory bloat via QPACK flaws—patch or disable vulnerable stacks now. #HTTP3 #QPACK #Vulnerability #MemorySafety #DoS #Cybersecurity thedailytechfeed.com/new-qpack-fl...
October 22, 2026 at 7:02 AM
Tiny HTTP/3 header batches can trigger 4,000× memory bloat via QPACK flaws—patch or disable vulnerable stacks now. #HTTP3 #QPACK #Vulnerability #MemorySafety #DoS #Cybersecurity thedailytechfeed.com/new-qpack-fl...