Bottom line: The IETF has published a new HTTP method, "QUERY", which has the potential to disrupt the security posture of web applications.
What's happening: In June 2026, the Internet Engineering Task Force (IETF) published RFC 10008, which defines the "QUERY" method, marking the first new standard HTTP verb since "PATCH" in 2010. This new method is intended to be used for querying data, rather than submitting data, and its implementation is expected to occur in HTTP/3. The new method is being implemented by major web browsers and web servers, including Google Chrome and Microsoft Edge.
What to do: Security leaders should monitor their web applications for potential vulnerabilities related to the new "QUERY" method and ensure that they are properly configured to prevent exploitation. Additionally, they should consider implementing additional security controls, such as Content Security Policy (CSP) and Web Application Firewall (WAF) rules, to mitigate the risk of attacks.