From UDP Probe to Working Tunnel: Analyzing Hysteria2 Behavior via QUIC, HTTP/3 and Client Events
A detailed technical study examined how commercial Hysteria2 VPN endpoints respond to different levels of network probing, starting from simple UDP packets and progressing to full QUIC handshakes and authenticated client connections.
The research used custom NetProbe tools on Windows and Linux to test real subscription endpoints, capturing both external probe results and decrypted traffic from an instrumented Hysteria2 client. Simple UDP probes received no response and timed out with status TIMEOUT_UNKNOWN, while properly formed QUIC Initial packets with TLS ClientHello and ALPN h3 successfully completed handshakes using TLS 1.3 and TLS_AES_256_GCM_SHA384.
An unauthenticated HTTP/3 GET request triggered immediate connection closure with H3_NO_ERROR (code 0x100), whereas a legitimate client sending POST /auth with Hysteria-Auth headers received the expected 233 status confirming authentication and UDP forwarding support.
Subsequent data transfer tests, including parallel requests and file downloads verified by SHA-256, were observed inside separate QUIC streams after authentication, confirming that the tunnel carried real traffic. The experiments also recorded internal client events alongside PCAPNG captures, allowing correlation of QUIC frames with Hysteria2-specific authentication and proxy operations.
The study highlights differences between external probing and authenticated client behavior, providing practical insight into how Hysteria2 servers handle reconnaissance versus legitimate VPN usage under real internet conditions.
Related articles
Splunk Enterprise Discloses 46 Vulnerabilities Including Critical Patroni Authentication Flaw
Splunk has published three security advisories detailing a total of 46 vulnerabilities affecting Splunk Enterprise and related components. Three of the issues were rated critical, with CVE-2026-76268 receiving a CVSS v3.1 base score of 9.8. The flaw resides in the Patroni REST API used for PostgreSQL cluster management within search head clusters, allowing unauthenticated remote attackers to execute arbitrary operating system commands. Another high-severity issue, CVE-2026-76266, enables local privilege escalation to root on Linux systems during package updates. The remaining vulnerabilities cover product code, internally identified problems, and third-party packages. Organizations are urged to apply the available patches promptly.
Smart Fish Tank Power Strip Server Breached, Killing Aquarium Fish During National Day Holiday
During China's National Day holiday, the cloud servers of Woda Technology's smart power strips for fish tanks were compromised by malicious hackers, causing widespread remote disconnections and power outages for user devices. The attack left heating rods, oxygen pumps, and circulation systems offline for hours, resulting in the deaths of koi, arowana, and other ornamental fish that users had maintained for years. Woda issued a public notice confirming the intrusion was not a product defect or user error but a deliberate network attack, and the company has since upgraded firewalls, added multi-layer cloud protections, deployed backup servers, and improved local offline logic to prevent future failures. The incident highlights a critical IoT design flaw where devices rely entirely on vendor cloud platforms for control, allowing attackers who breach the server to remotely manage household appliances at scale. Security experts note that the same architecture is used across smart speakers, locks, cameras, and other consumer devices, creating a broad attack surface with minimal updates or segmentation. Woda has reported the case to authorities and preserved logs for forensic investigation.
CISA Adds Five Actively Exploited Vulnerabilities in Apache Struts, BIND, ProFTPD, Strapi and ONLYOFFICE Docs to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026, confirming active exploitation in the wild. The affected products include Apache Struts, BIND, ProFTPD, Strapi, and ONLYOFFICE Docs, with CVEs issued between 2015 and 2023. Federal agencies have until October 11, 2026, to apply mitigations or remove affected systems. One highlighted issue, Strapi CVE-2023-22894, stems from plaintext storage of sensitive information, allowing authenticated attackers to extract user data via query filters. When combined with CVE-2023-22621, the flaws enable remote code execution. CISA also warned that some impacted products may no longer receive vendor support.
FBI Issues Alert on Active FortiBleed Campaign Harvesting Credentials from Exposed FortiGate Firewalls
The FBI and United States Secret Service have issued a joint alert regarding the FortiBleed campaign, an ongoing operation that targets internet-exposed FortiGate firewalls and SSL VPN gateways. Attackers have already collected 86,644 valid credentials from devices across 194 countries as of June 19, demonstrating the global scale of the indiscriminate scanning effort. The campaign relies on reused or previously leaked credentials combined with legacy SHA-256 password storage that enables offline cracking. Operators employ automated credential stuffing, the Go-based FortigateSniffer tool capable of intercepting 24 authentication protocols, and GPU-accelerated password cracking. Once inside, attackers create unauthorized administrator accounts and often delete legitimate ones, forcing victims to perform full device recovery rather than simple password resets. The activity was first documented in June, with the official alert released on October 7, confirming that scanning continues.