Unencrypted communications
Summary: PortSwigger Research describes an application that lets users connect over unencrypted connections, allowing an attacker positioned to view a legitimate user's traffic to record their interactions and obtain any information the user supplies. It notes that an attacker able to modify traffic could use the application as a platform for attacks against its users and third-party websites, and that mixing encrypted and unencrypted communications is an ineffective defense because active attackers can strip references to encrypted resources sent over an unencrypted connection.
Why it matters: The source states that unencrypted connections have been exploited by ISPs and governments to track users and inject adverts and malicious JavaScript, and that common defenses such as switched networks are not sufficient to prevent this.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026