Professional 1.6.20

Summary: Burp Suite Professional 1.6.20, released 22 June 2015, updated Burp Scanner to detect super-blind OS command injection by injecting commands such as nslookup against a Burp Collaborator domain and confirming that a DNS lookup reached the Collaborator server. The release also fixed a Collaborator Server bug that could deadlock threads on timed-out HTTP requests, issues in the site map UI introduced in 1.6.19, and a bug in interactive platform authentication prompting.
Why it matters: The Scanner still does not detect injections that fire long after payload submission, such as in an overnight batch job, so command injection that surfaces on a delay can sit unreported in the meantime. PortSwigger recommends that users running private Collaborator Server deployments update to the new version to address the deadlock bug.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026