Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
Agartha is a Burp Suite extension, authored by Volkan Dindar at version 3.0.0 and last updated 31 October 2025, that generates wordlists for SQL Injection, Local File Inclusion, and Remote Code Execution attacks and supports BCheck integration. It also...
PortSwigger released DAST 2025.10.1 on 4 November 2025, adding the ability to pause running or queued scans and resume them later without losing progress, with multiple scans pausable at once from the Scans page. The release also extended the...
PortSwigger released Burp Suite Professional/Community 2025.10.2 on 5 November 2025, adding extended OpenAPI 3.1 support and early OpenAPI 3.2 support to Burp Scanner, which the release notes say reduces parsing errors and improves compatibility with newer...
PortSwigger released Burp Suite Professional and Community 2025.10.3 on Thursday, 6 November 2025, fixing an issue that prevented some Kotlin-based extensions, such as MCP Server, from loading correctly in version 2025.10.2. The release is available as...
PortSwigger's BApp Store lists a third-party Burp extension called Spring Boot Dump Scanner, version 1.0.0, authored by Mukeshj008 and last updated 10 November 2025. The extension adds a scan check that detects publicly accessible Spring Boot actuator...
PortSwigger released Burp Suite Professional/Community 2025.10.4 on 11 November 2025, fixing an issue that prevented custom detection method settings for individual scan checks from saving correctly. The release also upgrades Burp's browser to Chromium...
PortSwigger researcher James Kettle released HTTP Anomaly Rank, an algorithm that scores each HTTP response by how different it is from the rest of a result set, weighting attributes by their stability and flagging responses with unique values. It is...
PortSwigger released Burp Suite Professional/Community 2025.11 on 13 November 2025, adding a Command palette invoked with Ctrl+K or Cmd+K for keyboard access to commands, project file search, BApp store extensions, and extension invocation. The release...
API expert Corey Ball's article "Hacking with Burp AI in the Chesspocalypse" describes testing PortSwigger's agentic AI assistant, Burp AI, on training targets as a digital sparring partner rather than an autopilot. In one example, when SQL injection...
PortSwigger Research describes Shadow Repeater, a Burp extension by Gareth Heyes that runs alongside Burp Repeater and automatically mutates the inputs a tester sends, then analyzes responses for anomalies and reports findings through Organizer. The...
PortSwigger released Burp Suite Professional and Community 2025.10.5 as a stable build on Wednesday, 19 November 2025 at 12:07 UTC, with downloads for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release fixes...
PortSwigger released Burp Suite Professional and Community Edition 2025.11.1 as an Early Adopter build on Wednesday, 19 November 2025 at 12:46 UTC. The release fixes an issue where changing the severity of multiple issues could cause Burp to...
PortSwigger released Burp Suite Professional and Community 2025.10.6 as a stable release on Monday, 24 November 2025 at 08:17 UTC, available for Windows, macOS, Linux and as a JAR. The release upgrades Burp's browser to Chromium 142.0.7444.176 on Windows...
PortSwigger released Burp Suite Professional and Community 2025.11.2 as an Early Adopter build on Monday, 24 November 2025 at 08:18 UTC. The release upgrades Burp's embedded browser to Chromium 142.0.7444.176 on Windows and Mac and 142.0.7444.175 on...
PortSwigger's BApp Store lists a Postman Collection Importer extension, authored by Abdul Rahman at version 1.0.4 and last updated 27 November 2025, that converts Postman collections and environments into Repeater tabs and Sitemap entries. The extension...
Hotpatch is a Burp Suite extension, authored by Software Secured and listed at version 1.0.18, that lets users hook into key functions with custom Python or JavaScript scripts. Through the Montoya API, those scripts can modify requests and responses,...
PortSwigger's BApp Store lists a Burp Suite extension called Multi-TOTP Authenticator, version 1.0.0, authored by Stephen Santilli and last updated 27 November 2025. The extension manages multiple time-based one-time passwords at once and inserts each TOTP...
PortSwigger is supporting TryHackMe's Advent of Cyber, a December event that releases a beginner-friendly hands-on security challenge each day, and is contributing prizes from its toolkit, which it says is used by 88,000 practitioners worldwide....
Magic Variables is a Burp Suite extension, authored by Software Secured and at version 1.4.19 as of 02 December 2025, that substitutes placeholders in HTTP traffic with dynamic, static, or predefined values. It is intended to help penetration testers track...
PortSwigger released two updates on December 5, 2025, so that default scans in both versions of Burp Suite can detect React2Shell (CVE-2025-55182 and CVE-2025-66478) in Next.js applications without extensions, custom checks, or scripts. The two critical...
PortSwigger released Burp Suite Professional/Community 2025.10.7 on 8 December 2025, adding a new active scan check for React2Shell, a critical remote code execution vulnerability affecting React Server Components in React and Next.js, tracked as...
PortSwigger released Burp Suite Professional and Community 2025.11.3 on 8 December 2025, adding a new active scan check for React2Shell, a critical remote code execution vulnerability affecting React Server Components in React and Next.js, tracked as...
BeanStack is a Burp Suite extension, version 0.7.0, that identifies Java frameworks and libraries by analyzing stack traces found in HTTP responses. It sends those stack traces to the BeanStack API at beanstack.io for fingerprinting and reports identified...
PortSwigger researcher Zak Fedotkin published research on December 10, 2025, showing full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting parser-level inconsistencies between REXML and Nokogiri, including attribute pollution,...
PortSwigger released AutoVader, a Burp Suite extension by Gareth Heyes that integrates DOM Invader with Playwright to automatically find DOM-based vulnerabilities through context menu actions. The extension launches an automated browser with DOM Invader...
PortSwigger released a winter 2025 update to Burp Suite DAST that adds scan freeze windows, which automatically pause scanning during defined times such as deployment cycles, maintenance windows, and change freezes instead of requiring manual pausing or...
PortSwigger Research lists HTTP Hacker, a Burp extension by Martin Doyhenard at version 1.1.0, last updated 11 December 2025, that gives advanced interaction and control over HTTP servers and proxies using persistent TCP/TLS connections. It offers complete...
Exporter++ is a Burp Suite extension, version 3.2.0 by Spyridon Chatzimichail and last updated 11 December 2025, that uploads identified security issues directly to Pwndoc or exports them to multiple document formats. Issues are automatically sorted by...
PortSwigger released Burp Suite Professional/Community 2025.11.4 on 12 December 2025, adding a default-enabled active scan check for React2Shell, a critical remote code execution vulnerability affecting React Server Components in React and Next.js, which...
PortSwigger released Burp Suite Professional and Community 2025.12 on 12 December 2025, adding collections that let Pro users share HTTP messages with other Pro users through a single end-to-end encrypted Burp link that PortSwigger says it never sees. The...