Smashing the token limit with overlapping fragments

PortSwigger Research feed covering novel web security research and offensive testing techniques, including HTTP desynchronization and request smuggling, SAML authentication bypasses, cookie and WAF bypasses, CSS and XSS data exfiltration, URL validation bypasses, cache poisoning, timing attacks, parser differentials, token forgery, and AI-assisted security testing. Several entries describe techniques capable of authentication bypass, session theft, sensitive-data exfiltration, or request-stream compromise. No specific CVE identifiers are provided in the supplied feed metadata.