Obscura has released a VPN service that splits traffic handling across two servers so no single party ever sees both a user's identity and their decrypted internet activity. The company says this architecture makes logging impossible even under legal compulsion or server compromise, and it uses a QUIC-based stealth protocol intended to disguise VPN traffic as regular HTTP/3 traffic to evade censorship and network filtering.
The Internet Archive said the Wayback Machine has faced surges of high-volume automated traffic, prompting it to deploy protective measures that occasionally block legitimate users. The organization updated the error message shown when requests are rejected with a 429 'too many requests' code and is refining how it distinguishes abusive bots from genuine visitors.
Cybersecurity guidance highlights that VPNs are most valuable in two situations: connecting to unsecured public Wi-Fi and preventing internet service providers from tracking browsing habits. Encrypting traffic through a VPN tunnel blocks eavesdroppers on shared networks and stops ISPs from logging and selling usage data to third parties, per FTC research cited in the coverage.
A developer released litelm, a lightweight library that replicates LiteLLM's core routing and message-translation functionality across LLM providers in roughly 2,900 lines of code with only two dependencies. It deliberately omits LiteLLM's larger feature set—proxy servers, caching, cost tracking, and dozens of add-ons—keeping only model routing, streaming, tool use, embeddings, and the Responses API. The API mirrors LiteLLM's function names and arguments, so existing users can switch by simply renaming their imports.
A hobbyist blogger purchased a WiFi-enabled Lidl Smart Kettle and began probing its network behavior after setting it up through the companion Lidl Smart Home App. Using nmap and netcat, they found the kettle opens a single TCP port (6668) that responds to connections but returns no identifiable banner or HTTP response, leaving its underlying protocol a mystery for further investigation.
A developer who previously built Onionservatory, a tool to audit Onion Service security configurations, has now released a companion tool called Onionspector. This new tool flips the perspective, showing users exactly what data points—from HTTP headers to browser fingerprinting signals like screen size, fonts, and Canvas/WebGL output—a website can collect about them when they connect, even over Tor.
OpenAI has updated its Python SDK to use HTTPX2 instead of HTTPX for both synchronous and asynchronous HTTP clients, with HTTPX2 now installed automatically alongside the openai package. Existing API calls, streaming, retries and timeout settings keep working without code changes, but the SDK no longer installs the httpx or certifi packages by default.
Pydantic has released HTTPX2, a new Python HTTP client library that continues the work of the HTTPX project, offering sync and async APIs, HTTP/1.1 and HTTP/2 support, and an optional command-line client. The project is positioned as a stewardship effort to keep the library actively maintained after HTTPX saw reduced development activity.
At Black Hat USA 2026, PortSwigger research director James Kettle unveiled an open source AI-driven tool called HTTP Terminator, designed to test whether AI could invent original hacking techniques rather than just find known bugs. The tool autonomously produced new HTTP desync, or request smuggling, attacks and used them to breach real enterprise sites, including several belonging to financial services firms.
Following up on his earlier SELF executable format that stores a program as a SQLite database, the author released self-httpd, a proof-of-concept web server whose code, website, routes, and visitor logs all live in a single SQLite file. The program reads its own instructions and writes new state, such as button-press logs, back into that same file transactionally, eliminating the need for separate folders like /var, /tmp, or /home.
PicoMQ is a new messaging system that delivers durable, HTTP-accessible streams while storing data on object storage rather than dedicated disks or brokers. It lets developers create a separate stream for each use case instead of consolidating records into shared topics, with each stream independently addressable and able to scale from idle to high throughput.
GoKawiil