Try it for yourself: the latest Port Swigger Research from Black Hat USA
Summary: At Black Hat USA, PortSwigger Research presented three releases: James Kettle's web timing attack techniques, Gareth Heyes's email parser exploitation for access control bypass and RCE, and Martin Doyhenard's web cache poisoning and deception via URL parsing discrepancies. The techniques are now available in the Param Miner extension, an Intruder payload wordlist for email splitting attacks, and Burp Scanner's built-in web cache deception tests.
Bottom line: Email address parsing discrepancies can let an attacker bypass access controls and reach remote code execution, and web cache attacks built on URL parsing gaps work against popular HTTP servers and CDNs in their default configurations.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026