Top 10 web hacking techniques of 2025: call for nominations

Summary: PortSwigger Research opened nominations for its annual Top 10 web hacking techniques list, a community project running since 2006 that collects reusable attack techniques from the year's blog posts, presentations, and whitepapers. The call asks for a URL and an optional note on what is novel, favors reapplicable techniques over individual vulnerabilities like log4shell, and states that non-web, tool-only, or non-innovative nominations will be filtered out before the community vote.
What you should know: The list's stated filter is technique over one-off bug: a JNDI Injection-style method gets reused against your systems for years, while a single patched vulnerability fades - so the entries that survive this vote are a reasonable proxy for what attackers will still be running next year.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026