Professional / Community 2025.12.3
Summary: PortSwigger released Burp Suite Professional and Community 2025.12.3 on 15 January 2026, adding collections that let Pro users share HTTP messages via an encrypted Burp link that PortSwigger says it cannot see. The release also adds OAuth2 Client Credentials flow support for API scanning, filters false positives from WAF-delayed payloads in time-based SQL injection detection, and upgrades Burp's browser to Chromium 143.
Why it matters: The new collections feature moves findings, reproduction steps, and proof-of-concept requests between Pro users through a single end-to-end encrypted link, so the security of shared exploit detail now depends on how those links are handled rather than on file exports.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026