In June 2026 the IETF published RFC 10008[1], defining a new HTTP method: “QUERY”. The HTTP protocol faced already by changes (HTTP/2, HTTP/2) but it’s the first new standard HTTP verb since “PATCH” in 2010!

This new method sits between “GET” and “POST” and can be resumed like this: “QUERY is a GET with a body”. It’s safe and idempotent: the request is processed without state change and can be automatically repeated or restarted without concern for partial state changes. The query itself lives in the request body instead of the URL, and it’s explicitly cacheable. Servers advertise the body formats they’ll accept via a new “Accept-Query” response header.

If you defend web infrastructure, the interesting part isn’t the RFC. The risk is that every control you own that pattern-matches on HTTP methods was written before “QUERY” existed. WAF rules, API-gateway allowlists, CSRF middleware, cache keying, load-balancer method handling is written in terms of a known verb set: GET, POST, PUT, DELETE, PATCH.  Drop a sixth verb that behaves like a hybrid of the first two into that world and each control now has to make a deliberate decision about it. Most of them currently make an accidental one.

And the behaviour in the wild is genuinely inconsistent. Researchers found that nginx’s limit_except pattern and Django’s View class reject QUERY outright, while curl, FastAPI’s explicit routes, Caddy and Traefik pass it through untouched. On caching, one researcher built a QUERY-only API and found nginx forwards it happily and caches it never[2].

Think about this HTTP request:

curl -X QUERY https://target.com/api/search \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "q=' OR 1=1--" -v

If your WAF signatures (SQLi, XSS, command injection) are bound to “POST” bodies but never taught that “QUERY” also carries a body, you get a clean inspection bypass. The test is trivial: send the same malicious payload over “POST” and over “QUERY” and diff the outcome. If the “QUERY” version sails through where the “POST” version gets blocked, that’s a live gap, not a theoretical one.

Because “QUERY” is cacheable and safe by spec, caches that don’t key on the full request body can be poisoned into serving one user’s malicious payload to the next, and CSRF middleware hardcoded to the classic state-changing verbs will wave through any “QUERY” endpoint that carries an unintended side effect.

The new method is not popular yet, here is an overview of what I found:

Layer	Component	Status
Clients	curl	Works today via “-x query”
	Node.js / fetch (server-side), Python (httpx/requests), Go net/http, Rust reqwest	Already let you send arbitrary method strings, so QUERY works between your own services right now
	Browser fetch() / XHR	Can send it, but QUERY is not CORS-safelisted → always triggers an OPTIONS preflight; browser HTTP cache should not be assumed to cache QUERY responses yet
	.NET 10	First-class support out of the box
	HTTP.jl (Julia)	Merged June 2026 — client + server, retries, redirect handling, Accept-Query
Servers / proxies	nginx	Proxies it, never caches it. Four identical QUERY requests hit the backend four times; four POSTs hit it once. Also, the limit-except pattern silently rejects QUERY.
	Caddy, Traefik	Pass it through untouched
	Apache	Needs config adjustment to recognize the method and handle OPTIONS/CORS
Frameworks	Fast API	Explicit routes pass it through
	Django	The View class rejects it outright
	Spring (Java)	Maintainers deliberately scoping it down to “teach the framework QUERY exists” and waiting on adoption feedback before expanding
CDN	Cloudflare, Akamai	Co-authored the RFC, so edge/CDN support is expected to lead framework support, but reliable at-scale QUERY caching isn’t there yet

What can you actually do?

Update your rules/regexes to support the new verb:

http.method in ("GET","POST", "QUERY")

I searched across my HTTP-related logs and found no occurrence of QUERY request but it’s for sure a question of time.

And from a malware point of view? Is there a risk? Most of what a modern SOC actually relies on to catch C2 is behavioral, and behavioral detection doesn’t care about the verb:

• Beaconing analysis (RITA/AC-Hunter-style connection-count and interval work), jitter/timing, volume, and flow shape are all method-agnostic. A “QUERY” beacon beacons exactly like a “POST” beacon.
• JA3/JA4 and TLS fingerprinting sit below the HTTP method entirely.
• For HTTPS C2 — which is nearly everything now — the method is inside  the TLS tunnel. A network sensor without interception never sees “GET” vs “POST” vs “QUERY” in the first place, so “QUERY” changes nothing unless you’re decrypting.

[1] https://www.rfc-editor.org/info/rfc10008/

[2] https://dev.to/alexgeorgiev17/nginxs-limitexcept-block-silently-rejects-the-new-http-query-method-1gcg

Xavier Mertens (@xme)

Senior ISC Handler | SANS Principal Instructor | Freelance Consultant

Xameco | PGP Key

On August 24, 2026, Counter Threat Unit™ (CTU) researchers observed an Exploit underground forum persona named “Optimus_Prime” advertising an uncensored AI subscription service named Luciferus. The persona joined Exploit on April 18, and their profile displays a “coding / coder” activity label. As of September 4, the persona has published 21 posts on the forum. The August advertisement describes Luciferus as an AI system that answers requests without moral or ethical restrictions and claims that it is based on a proprietary model that has “120 billion parameters” (see Figure 1). 

Figure 1: Luciferus advertisement posted by Optimus_Prime on Exploit forum

CTU™ researchers did not independently verify the model architecture, parameter count, performance, privacy claims, or advertised capabilities. However, they assess with low confidence that Luciferus is built on Qwen, which is a family of large language models (LLMs) developed by Alibaba. Qwen provides underlying AI capabilities, including natural language understanding and generation, for a range of AI applications and services.

CTU researchers previously observed threat actors advertising “jailbroken” versions of ChatGPT and Claude in which ethical constraints were removed so they could be used for malicious purposes. However, “proprietary models” like Luciferus are designed or configured without safeguards from the outset to allow greater control, persistence, and the ability to tailor capabilities to specific user communities, including underground forums. Proprietary model claims can be misleading, as many of the services are likely based on fine-tuned open-source models, custom system prompts, or orchestration layers rather than entirely new foundation models. Training a genuinely novel LLM requires significant expertise, data, and computing resources.

The advertisement lists three tiers available for a monthly subscription price: Inquisitor ($35), Archdeviel [sic] ($55), and Prince of Darkness ($75). It also refers to an “Individual Embodiment” VIP level that provides access to a personal AI model deployed separately for their project, custom models trained on their own data and specific tasks, dedicated computing power that is not shared with other users, and full control over the context window and response temperature. The cost of this VIP service is based on user requirements. The website does not mention that option and lists different names and prices for the other tiers: Junior ($22), Middle ($34.75), and Pro ($47.14) (see Figure 2). 

Figure 2: Offerings listed on the Luciferus website

Figure 3 shows the Luciferus Junior model’s response to a “simple RAT in python” prompt. The Russian-language introduction describes a simple Python remote access trojan and presents networking and command execution functionality before listing source code. These results support the advertisement’s claim that the service will respond to overt requests for malware development. CTU researchers did not execute, test, or assess the completeness of the generated code. 

Figure 3: Luciferus response to an explicit RAT-generation prompt (generated code redacted)

The emergence of Luciferus aligns with a broader trend in which threat actors are increasingly commercializing AI through underground forums, Telegram channels, and cybercriminal marketplaces. Rather than developing their own models, many threat actors are offering access to uncensored or modified LLMs via AI-as-a-service schemes in the same way malware, phishing kits, and ransomware are commoditized. Well-known examples include WormGPT and FraudGPT, which were marketed on underground forums as unrestricted alternatives to ChatGPT that are capable of generating phishing emails, business email compromise (BEC) lures, malicious scripts, and malware code. Luciferus appears to be a more stable option that relies on an uncensored local LLM instead of jailbreaking a mainstream LLM provider. CTU researchers have also observed threat actors selling brokered access to legitimate AI platforms, sharing API keys, offering AI prompt-engineering services, and advertising access to multiple AI models as a packaged service. 

CTU researchers have also identified a steady increase in posts advertising AI-enabled services, dedicated AI discussion channels, and recruitment efforts seeking AI specialists to support cybercriminal operations. These developments suggest that AI is an increasingly accessible component of the cybercrime ecosystem, lowering barriers to entry and enabling less technically skilled actors to access capabilities that were previously limited to experienced developers. Luciferus represents the latest evolution of this trend, positioning itself as a purpose-built “uncensored” AI service that explicitly advertises its willingness to respond to malware development requests without the ethical safeguards present in mainstream commercial models.

Welcome back to Foreign Policy’s Situation Report. This is our last “regular” edition before we bring you a series of special daily pop-ups from the United Nations General Assembly high-level week (or UNGA, as you might know it) in New York next week! John and Rishi will both be having a bunch of interesting conversations both on and offstage at FP’s smorgasbord of sideline summits—and we’ll be in your inbox as always. Reach out if you’d like to connect or have something interesting to share.

Alright, here’s what’s on tap for the day: Trump’s cyber-offense plans for the private sector, the AI doomsday panic, and the ever-out-of-reach U.S.-Iran deal.

---

Among the many upheavals to U.S. foreign policy in President Donald Trump’s second term thus far has been a fundamental reshaping of the way that Washington approaches cyberwarfare.

The Trump administration (with Elon Musk’s help) has made massive cuts to the U.S. government’s cyber posture, cutting staff and programs at organizations such as the State Department and the Cybersecurity and Infrastructure Security Agency (CISA).

But that has been accompanied by a push to conduct more offensive cyberattacks against adversaries—as the United States did in both Venezuela and Iran—rather than simply defending U.S. systems from Chinese, Russian, Iranian, or North Korean hackers. Those adversaries often blur the lines between government and the private sector, with criminal hackers and so-called hacktivist groups often targeting critical U.S. systems in alignment (if not direct affiliation) with their respective regimes.

The Trump administration’s strategy to bridge the gap involves some line-blurring of its own between the U.S. government and private companies, which may soon start hacking back with the government’s blessing. Trump first laid out the proposal in a national security memorandum around a month ago, in which he directed the government to partner with “vetted” private companies to conduct cyberattacks and surveillance against foreign transnational criminal networks that target U.S. citizens.

“I think the big thing from my perspective on cyber, and from the president’s perspective, is engaging with private industry in a new way,” White House national cyber director Sean Cairncross told an audience at the Billington Cybersecurity Summit in Washington last week.

The FBI also announced its first-ever unclassified cyber strategy at the summit, which calls for more joint operations with private companies. The strategy’s goal is “to make industry an operational partner in this fight, as opposed to just somebody we shared threat intelligence back and forth with,” Brett Leatherman, the assistant director of the FBI’s cyber division, told reporters.

The FBI has already undertaken joint operations with companies such as Google, Microsoft, Meta, and the cybersecurity firm CrowdStrike to disrupt criminal hackers this year, and the U.S. military is reportedly preparing to undertake a similar shift in which it will bring in private contractors to conduct cyberoperations.

A big experiment. Cybersecurity experts and former officials who spoke to SitRep expressed cautious optimism about the approach—if done correctly.

“I think this works as an experiment because we’re always short capacity,” said Anne Neuberger, who served as deputy national security advisor for cyber and emerging technology in the Biden administration. “If this approach can bring just more operations to bear on targets like these that fundamentally end up operating with a lot of impunity, my own view is that’s a good thing.”

Large tech companies such as Google and Microsoft build the software and systems used by governments, individuals, and businesses alike, and are often the prime targets of—and thus first line of defense against—adversarial hackers.

“Google or Microsoft or some of the other larger corporations actually get to help us with operations because they’re powerhouses, and I think the bureau has definitely realized that the private sector has a lot of the expertise,” said Megan Rolander, a senior executive at the cybersecurity firm Black Kite who previously spent over 15 years working on cyberoperations at the FBI. “Folks are using their technology—no one’s using the bureau’s technology,” she added.

Careful choices. But there are a few glaring issues that the government will have to reckon with. Foremost is the concern about nation-state retaliation against U.S. companies for hacking groups tied to governments.

Leatherman acknowledged that that is something U.S. government agencies will have to think about. Even if foreign nations “are using industry right now to hack us in ways that are outside the norms of cyberspace operations,” he said, the United States has “to do it in a way that is lawful. We have to do it in a way that protects organizations just like you protect our own personnel.”

Neuberger said the main thing she’ll be watching for is which companies sign up to be the tip of the spear. “The government has the right controls built in, they’re going to approve it, so I’m assuming they’re not going to approve the cowboys,” she said. “I knew when I was in government—and still today—which companies I would trust, and which companies, if they submitted something, I’d be like: ‘OK, why don’t we get back to you.’”

---

What should be high on your radar, if it isn’t already.

AI “perfect storm.” Artificial intelligence (AI) is evolving at a blistering pace, and it’s causing existential dread. There are now growing calls for tech companies to halt development. Rishi spoke to AI experts about why AI fears have reached a fever pitch, which they attributed to a “perfect storm.” Read the piece, which also gets into the complicated geopolitics of pumping the brakes on AI development, here.

Deal or no deal. Trump this week once again suggested that Iran wants to make a deal to end the war, but Tehran has signaled that no agreement can be reached until its conditions are met. The United States is losing the Iran war by virtually every metric, which John wrote about this week, but the White House maintains that it has the upper hand and said Trump is “satisfied letting the inevitable Iranian collapse play out.” But there’s no guarantee that the administration’s economic pressure campaign will breed results (more on that in Hot Mic).

---

---

Trump does not appear to be in a rush to end the Iran war, despite its unpopularity among U.S. voters ahead of November’s midterm elections. The war has driven up energy prices and is fueling inflation, but Trump on Wednesday said this is a “very inexpensive price to pay for what we’ve done.” John spoke with Gregory Brew, a top Iran expert and senior analyst with Eurasia Group, about where the war stands and what’s driving Trump’s approach.

“I genuinely don’t think Trump is at the moment too concerned about the impact of high fuel and high oil prices on the White House’s position and on his own personal position to an extent that would force him into what he and the administration sees as a very bad deal with Iran. Because that’s ultimately the calculus here,” Brew said. Iran wants Washington to acknowledge its control over the Strait of Hormuz and return to the June memorandum of understanding, but from the administration’s perspective “that’s a really bad deal, and it’s not one that they want to accept.”

“Right now, their feeling is we can absorb high oil prices, high gasoline, and high diesel prices, at least for the next few months. And then see where things lie post-midterms,” Brew said. Trump also does not appear to care about midterms all that much, Brew said, which the president actually explicitly stated back in May. After all, the president has often bypassed Congress in pursuit of his agenda. “Trump’s focus moving forward is going to be on foreign policy and choosing his successor for 2028. So, the midterms don’t really matter,” Brew said.

---

Friday, Sept. 18: Parliamentary elections are set to begin in Russia and will last through Sept. 20.

Tuesday, Sept. 22: The opening of general debate at the 81st session of the United Nations General Assembly.

Wednesday, Sept. 23: Morocco is poised to hold parliamentary elections.

Thursday, Sept. 24: Trump is set to host Chinese President Xi Jinping at the White House.

---

$38 billion—the cost of the Iran war for the United States so far, according to the Congressional Budget Office.

---

“Surely, we need sufficient means of control before it is all too late?”

—Britain’s King Charles, speaking about the potential “existential” dangers of AI at a summit in Scotland.

---