Intruder bugfix - nonstandard charsets

Summary: PortSwigger reports that a bug in Burp Suite's Intruder tool caused the payload positioning marker to display as a red box or another character instead of the § symbol when the JRE was set to unusual character sets, affecting Japanese users and some Linux users. The fix is included in the next release, and the author asks anyone who experienced the problem to try it and report back.
Key Takeaway: A tool that silently fails to recognize its own payload markers when a tester's locale isn't en-US means attacks may not launch at all, so teams running non-English or mixed-locale environments should verify Intruder behaves correctly after updating.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026