# Primary research and transfer limits

- **Orange Tsai, DEVCORE — [Apache Confusion Attacks](https://devco.re/blog/2024/08/09/confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-en/).**
  Shared request fields acquired different meanings in different modules. Trace the transformation
  after a local validation decision and ask whether the downstream consumer still acts on the checked
  resource. Deployment and configuration determine whether a particular path exists.
- **Griffin — [Mozilla Taskcluster report](https://hackerone.com/reports/3782701).**
  An open JSON filter reached a dependency's executable operator through an actual anonymous resolver
  and permitted upstream call. The nonempty collection was part of the trigger. This illustrates why
  caller paths, dependency semantics, configuration and realistic runtime inputs all matter.
- **Simon Koeck — [DevSite session chain](https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce).**
  Authentication of a serialized object depended on a separate key-handling assumption. Controls
  isolated that dependency before attributing a downstream effect. Do not use the original credentials
  or production targets; analyze the causal relationship in an owned fixture.
- **Gareth Heyes — [Splitting the email atom](https://portswigger.net/research/splitting-the-email-atom).**
  A representation crossing parser boundaries may change the identity inferred by a consumer. Connect
  that difference to a specific security decision rather than treating exotic syntax as impact.

Locally written summaries, read on 2026-10-13. Full articles are not copied or relicensed here.