A modern, elastic design for Burp Collaborator server
Summary: PortSwigger re-architected its public Burp Collaborator server from a monolith that stored data in RAM to a cloud-native, elastic design with multiple service instances behind load balancers and a Redis database. The change was driven by growth from roughly 8,000 Burp Suite Professional users in mid-2015 to over 60,000 in early 2022, plus 800 organizations using Burp Suite Enterprise Edition and a surge in traffic from Log4Shell scanning.
Key Takeaway: Collaborator interaction data is now encrypted at rest and requires both a user secret and a master secret to decrypt, with data deleted immediately after polling and purged as stale after 14 days - so the out-of-band findings your team relies on now sit behind a two-key decryption model rather than in server memory.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026