Professional / Community 1.7.26

Summary: PortSwigger released a Burp Suite update on 3 August 2017 that adds new scan checks for file upload functionality, including detecting server-side rendering of uploaded PDF documents by embedding PDF JavaScript to trigger a Burp Collaborator interaction. The new detection techniques produce new versions of existing issues including PHP code injection, SSI injection, reflected XSS, stored XSS, and external service interaction, and the release also fixes bugs including one affecting NTLM authentication.
What's compelling: Anyone running a private Burp Collaborator server must update it now, since the new scan checks depend on changes to the Collaborator server and an out-of-date server will trigger a startup alert.

Read the original at PortSwigger Research ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026