Business as usual
Summary: PortSwigger's Dafydd Stuttard writes that UK amendments to the Computer Misuse Act, on the statute book for over a year but not yet in force, make it illegal to supply software "believing that it is likely to be used to commit an offence," and that Burp was downloaded 10,483 times last month. He notes the Crown Prosecution Service has published guidance acknowledging a "legitimate industry" making dual-use testing software and directing prosecutors to establish criminal intent, which he calls a vague set of factors that leave wide discretion over who is pursued.
What's compelling: Under a literal reading, every producer of hacking tools is criminalized, and it falls to prosecutors' judgment - informed by guidance Stuttard calls trivially satisfiable by any criminal - to decide who faces action, a discretion he contrasts with a British judge who once asked lawyers to explain what a website is.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026