Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger released Burp Suite Professional and Community Edition 2026.4 on 23 April 2026, introducing a combined installer for both editions and removing the Java binary as a hardening measure. The release also lets extensions stop requests from being...
PortSwigger's BApp Store lists Firewall Ferret, a Burp Suite extension by Anthony Hanel, version 1.3.0, last updated 23 April 2026. The extension lets a tester manually insert junk data and adds junk data to Active Scans by duplicating each scan check,...
PortSwigger's BApp Store lists a Burp extension called Host Header Inchecktion, version 1.3.0, by Fabian Binna, last updated 23 April 2026, which actively tests a set of injection types to find host header injection vulnerabilities and creates a scan issue...
PyBurp is a Burp Suite extension, authored by cyal1 and listed at version 1.0.2, that provides predefined Python functions for modifying HTTP and WebSocket traffic, registering context menus, processing Intruder payloads, running passive and active scans,...
PortSwigger received the Overall Judges' Award at the Northern Tech Awards 2026, an event run by GP Bullhound and held on 23rd April 2026 at the Imperial War Museum North in Manchester. The award goes to the company judged strongest across growth,...
PortSwigger released Burp Suite Professional and Community 2026.4.1 as an early adopter build on Wednesday, 29 April 2026 at 13:29 UTC. The release fixes a bug that prevented macOS users from running Bambdas. What's compelling: Any macOS tester on Burp...
A Burp Suite extension called Redsys PSD2 Request Signer, authored by migue27au at version 2.0.0 and last updated 30 April 2026, automatically signs outgoing requests to the Redsys PSD2 API by computing and injecting the required cryptographic headers. The...
Swapper is a Burp Suite extension, version 1.0.0 by author roidrage52, that automates match-and-replace of tokens, CSRF values, and authentication headers across Burp tools. It periodically fetches a fresh value from a configurable endpoint, extracts it...
PortSwigger Research describes custom scan checks in Burp Suite as a way to encode senior pentesters' testing logic into repeatable automated tests, citing the React2Shell disclosure where it released a check immediately and a major MSSP used it in live...
PortSwigger released Burp Suite Professional and Community Edition 2026.4.2 on 8 May 2026, introducing a combined installer for both editions while existing setup, configuration, and licensing continue to work as before. The release also lets extensions...
Intigriti Quick Scope is a Burp Suite extension, version 1.1.1, that automates bug bounty project and scope setup by fetching program data directly from the Intigriti Researcher API. It imports in-scope and out-of-scope domains from a researcher's...
PortSwigger's Dafydd Stuttard writes that the traditional AppSec value chain of finding, proving, and fixing vulnerabilities will be automatable end-to-end, and that open-weight models will likely match today's frontier capabilities within a few months. He...
PortSwigger released Burp Suite Professional and Community 2026.4.3 on Wednesday, 13 May 2026, fixing a high-impact vulnerability in browser-based crawling of malicious websites on Windows. The release also fixes an issue where Burp ran disabled custom...
PortSwigger released DAST 2026.5.1 on 21 May 2026, adding the ability to configure a list of hosts that connect directly and bypass the system-level external proxy. The release also fixes bugs affecting self-hosted Windows scanning machines and scope rule...
Burpcord is a Burp Suite extension by Jon Marien, version 2.7.1, that integrates Discord Rich Presence and broadcasts real-time testing activity as a status on the user's Discord profile. It updates presence with live metrics such as request counts, scan...
PortSwigger released Burp Suite DAST 2026.5.2 on 8 June 2026, adding Negotiate auth scheme and SPNEGO encoding options to NTLM credential setup for site configurations and upstream proxy settings. The options apply to both NTLM v1 and NTLM v2 and match...
PortSwigger released Burp Suite Professional/Community 2026.6 on 11 June 2026, updating the bundled Java runtime to Java 26 (26.0.1) and upgrading Burp's browser to Chromium 149.0.7827.103 on Windows and Mac and 149.0.7827.102 on Linux. The release also...
PortSwigger ran Extensibility Month on its Discord server throughout May 2026, with talks, workshops, community sessions and the Burp Extension Awards decided by community vote. More than 200 nominations were submitted for 46 extensions, with Highlighter...
The Qualys WAS extension connects Burp Suite with the Qualys Web Application Scanning module on the Qualys Cloud Platform, letting users import a WAS finding into Repeater for manual validation and send Burp Scanner issues to Qualys WAS for combined...
PortSwigger's BApp Store lists RequestRedactorX, a Burp extension by Blazej Zajaczkowski, version 1.0, that removes, censors, or masks sensitive data from HTTP requests before they are copied to the clipboard. It offers four copy modes and a configurable...
Stepper is a Burp Suite extension, version 2.3.4, that chains multi-step HTTP request sequences with automatic variable extraction, session management, and conditional logic. It lets users define a login or token-refresh flow once, extract values from...
PortSwigger released a Burp Suite extension, version 0.1.0 by Peter Hendy, that targets Model Context Protocol servers by automating discovery of their tools, resources, resource templates, and prompts. It then builds JSON-RPC 2.0 requests with fuzzable...
PortSwigger is attending Black Hat USA 2026, BSides Las Vegas, and DEF CON 34, with a booth at Black Hat (#5342) and a table at BSides, plus a four-hour Burp extension and Bambda workshop co-presented by Hannah from PortSwigger and Burp Ambassador...
PortSwigger's BApp Store lists Command Runner, a third-party Burp Suite extension that executes system commands from within the Burp interface through a tabbed command environment with a persistent command playbook. The listing, version 1.0.0, states that...
PortSwigger lists a Burp Suite extension, version 2.3.2, that provides coverage of all ten OWASP API Security Top 10 (2023) categories through active and passive scan checks. Findings are labelled by OWASP API category so scan output maps directly to the...
PortSwigger released Burp AT on 16 July 2026, an agentic AI capability for Burp Suite Professional that pursues testing goals set by the user using Burp's own deterministic tooling rather than improvising its own. Tasks run in one of three autonomy modes,...
The CKEditor Passive Scanner is a Burp Suite extension, version 3.0.0 by Masoud Zivari (code5ecure), that detects CKEditor v4.x and v5.x installations in HTTP responses, extracts version information, and enumerates loaded plugins without sending active...
PortSwigger's BApp Store lists a Burp Suite extension, version 1.0.0 by Moein Erfanian, that adds a context menu option generating an x8 command from a selected HTTP request and copying it to the clipboard. The listing, last updated 16 July 2026, notes the...
PortSwigger added four new members to its Official Burp Ambassador Program, launched in April: Katie, a cybersecurity educator and content creator; Malek, an information security consultant and penetration tester; Yogesh, a Senior Principal Security...
PortSwigger released Burp AT on 23 July 2026, an agentic AI capability for Burp Suite Professional that pursues testing goals using Burp's own deterministic tools rather than improvising its own. Tasks run in one of three autonomy modes, from checking...