Draft new extensibility API

Summary: PortSwigger released a draft of a new Burp Suite extensibility framework whose API lets extensions register listeners for runtime events, add tabs to Burp's main window and message editors, add context menu items, and provide custom scanner insertion points, scanner checks, Intruder payload generators and processors, and session handling actions. The draft aims to preserve backwards compatibility, so legacy extensions compiled against the old interfaces should load as binary-compatible JARs, though code compiled against the new interfaces needs minor changes because get/set methods for server host, port and protocol and helpers for request URL and response status code were removed from the IHttpRequestResponse and IScanIssue interfaces.
Key Takeaway: Extensions built against the new interfaces must supply their own implementations of IHttpRequestResponse and IScanIssue, and the removed host, port, protocol, URL and status-code methods will not be there to call - so any in-house Burp tooling compiled against the draft API needs review before the API changes again.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026