Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
At Black Hat USA and DEFCON 2025, PortSwigger Director of Research James Kettle presented research titled "HTTP/1.1 Must Die: The Desync Endgame," arguing that HTTP request smuggling remains widespread and that patching individual implementations will...
At Black Hat USA and DEFCON 2025, PortSwigger Director of Research James Kettle presented research titled HTTP/1.1 Must Die: The Desync Endgame, arguing that HTTP request smuggling (desync) attacks remain widespread and compromise tens of millions of...
At Black Hat USA and DEFCON 2025, PortSwigger Director of Research James Kettle presented research arguing that HTTP request smuggling, or desync attacks, remains prevalent and compromises tens of millions of websites. The research found several major CDNs...
At Black Hat USA and DEFCON 2025, PortSwigger Director of Research James Kettle presented research arguing that HTTP request smuggling, or desync attacks, remains a systemic protocol-level threat affecting tens of millions of websites, and that patching...
PortSwigger released Burp Suite Professional/Community 2025.7.2 on 7 August 2025, adding wider color choices and automatic next-color assignment for Repeater tab groups, form detection in the live passive crawl that adds forms to the site map with a...
PortSwigger released Burp Suite Professional/Community 2025.8 on 7 August 2025, adding Burp AI to Repeater so users can run prompt-driven tasks from any Repeater tab and view a step-by-step log of actions and findings on the Dashboard. The release also...
PortSwigger released Burp Suite Professional and Community 2025.7.3 as a stable build on Thursday, 14 August 2025 at 07:16 UTC, with downloads for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release upgrades...
PortSwigger released Burp Suite Professional and Community Edition 2025.8.1 as an Early Adopter release on Thursday, 14 August 2025 at 07:16 UTC. The release upgrades Burp's embedded browser to version 139.0.7258.67 for Windows and Mac and 139.0.7258.66...
PortSwigger's BApp Store lists a third-party Burp extension, version 1.0.2 and last updated 14 August 2025, authored by Ganesh Babu, that generates time-based one-time passwords for Okta accounts and injects them into HTTP requests automatically. The...
PortSwigger released Burp Suite Professional and Community 2025.7.4 as a stable build on Tuesday, 19 August 2025 at 14:23 UTC. The release fixes an issue where the workspace layout was not saved when closing Burp in some situations, and upgrades Burp's...
PortSwigger released Burp Suite Professional and Community 2025.8.2 as an Early Adopter build on Tuesday, 19 August 2025. The release fixes an issue where the workspace layout was not saved when closing Burp in some situations, and upgrades Burp's browser...
PortSwigger researcher James Kettle published a post explaining that request smuggling proofs of concept which only work when connections are reused are usually false positives, since HTTP/1.1 keep-alive and pipelining concatenate requests and responses on...
PortSwigger's BApp Store lists AWS Sigv4, a Burp Suite extension by Anvil Secure at version 0.2.9, last updated 21 August 2025, that signs AWS HTTP requests with Signature Version 4 authentication. Because SigV4 signatures carry a timestamp and limited...
PortSwigger researcher Gareth Heyes published a technique on 26 August 2025 for stealing attribute data through inline CSS styles alone, without selectors or stylesheet imports, by chaining CSS if-statement conditionals to test attribute values and trigger...
PortSwigger researcher James Kettle presented new classes of HTTP desync attack in a video with ethical hacker John Hammond, demonstrating critical vulnerabilities affecting tens of millions of websites, including core infrastructure within major CDNs. The...
PortSwigger recapped its first-half 2025 updates to Burp Suite DAST, including portfolio-wide recurring scan scheduling, custom asset tags, automatic authentication token refresh during API scans, and scan triggers from Postman Collections. The scanner...
A Burp Suite extension called Collaborator Everywhere inserts Burp Collaborator payloads into all HTTP headers and URL parameters of in-scope traffic during active testing, aimed at uncovering SSRF and blind RCE. Version 2.0.3, authored by Andreas Brombach...
PortSwigger researcher @zakfedotkin published a proof of concept showing that UTF-8 whitespace characters such as U+2000 can disguise a __Host- prefixed cookie so browsers treat it as unrestricted while servers like Django and ASP.NET trim the character...
Deep Data Injector is a Burp Suite extension that lets pentesters define payload insertion points in non-standard locations such as encoded regions or serialized data, including encoded cookies the scanner would not normally target. It registers as a scan...
PortSwigger Research lists a Burp extension called AI Prompt Fuzzer, authored by Mohamed Idris, that automates prompt fuzzing against AI APIs using customizable payloads to find prompt injection vulnerabilities. Version 3.0.0, last updated 04 September...
PortSwigger says it surveyed AppSec leaders across several industries and regions earlier this year and more than half reported struggling with the complexity of modern applications, amid expanding application estates, growing API usage, and faster release...
PortSwigger's BApp Store lists a third-party Burp Suite extension called Google Authenticator, authored by Alexandre Teyar of Aegis Cyber, that turns Burp into a TOTP client generating and applying current 2FA codes to HTTP requests in real time. Version...
PortSwigger lists WebSocket Traffic Monitor & Exporter, a Burp Suite extension by Erinna Anthony at version 1.0.0 and last updated 09 September 2025, for real-time monitoring, capturing and exporting of WebSocket traffic across all Burp tools. It adds tool...
Will Rabb of Aon's Cyber Labs released version 1.0 of Blazor Traffic Processor, a Burp Suite extension that converts BlazorPack serialized messages into human-readable JSON and back. The extension lets testers inspect, modify, and tamper with Blazor Server...
PortSwigger's BApp Store lists an extension called IP Rotate, version 2.0a by David Yesland, last updated 10 September 2025, which routes all requests to a configured target domain through AWS API Gateway endpoints in multiple regions so each request...
PortSwigger released Burp Suite Professional/Community 2025.8.3 on 11 September 2025, adding Burp AI to Repeater so users can run prompt-driven tasks from any Repeater tab and view a step-by-step log of actions and findings on the Dashboard. The release...
PortSwigger released Burp Suite Professional / Community 2025.9 on 11 September 2025, adding support for custom Burp Scanner checks written in Java through the Montoya API, alongside the existing BChecks language. The release also redesigns the scan...
PortSwigger's BApp Store lists Organizer Notes, a Burp Suite extension by Luqman Hakim Y at version 0.0.4, last updated 11 September 2025. The extension lets testers create, categorize, and attach notes to HTTP requests sent to the Organizer, keeping...
A bug bounty hunter who started hacking at 16 by experimenting with Wi-Fi networks and phishing now uses Burp Suite alongside HackerOne to find vulnerabilities, and one of his most notable wins was a $38,000 bounty uncovered with Burp's HTTP Request...
PortSwigger released Burp Suite Professional and Community 2025.8.4 as a stable build on Friday, 12 September 2025, upgrading Burp's embedded browser to Chromium 140.0.7339.133 on Mac, 140.0.7339.128 on Windows, and 140.0.7339.127 on Linux. The release...