Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger Research lists an HTTP/3 Adapter extension, version 0.0.1, by Tom Stacey, last updated 23 September 2026, that intercepts requests, converts them to HTTP/3 (QUIC), transmits them to the target, and converts responses back to a compatible HTTP...
PortSwigger researcher @t0xodile released HTTP/3 support for Turbo Intruder, which exceeded 100,000 requests per second over Wi-Fi from a laptop and reached roughly 180,000 RPS when run from a cloud box in the target's region, up from 30,000 RPS over...
PortSwigger lists a Burp extension, MongoBleed Detector, that tests for CVE-2025-14847, a memory leak vulnerability in MongoDB, by running manual connection tests from a dedicated UI tab. The extension connects to a specified host and port, captures leaked...
PortSwigger's BApp Store lists History Explorer, a Burp Suite extension by marduc812 at version 2.1.0, that searches proxy history for a literal string or regular expression and groups every match under the host it came from. Matches appear in an...
PortSwigger researcher Alex showed that overlapping short CSS fragments can be stitched back into long tokens, recovering a 12-character hex token with a 223,365-byte stylesheet (4,128 selectors) and a 1,334,437-byte sheet (25,088 selectors) that left one...
PortSwigger research director James Kettle reports that when he gave a swarm of agents broad, open-ended prompts to pursue an autonomous security research cascade, the process burned many tokens and yielded only one significant discovery. Analyzing the...
Turbo Intruder is a Burp Suite extension from PortSwigger, authored by James Kettle at version 2.0.1, for sending large numbers of HTTP requests and analyzing the results. It is meant to complement Burp Intruder for attacks needing extreme speed or...
PortSwigger released Burp Suite Professional and Community 2026.9.1 on 7 October 2026, adding the ability to export individual SMTP Collaborator interactions as .eml files that include the email content and Collaborator metadata and open in standard email...
PortSwigger released Burp Suite DAST 2026.10 on 8 October 2026, adding the ability to apply triage decisions to matching issues, so marking an issue as a false positive, accepted risk, or changing its severity updates matching issues on the site and...
PortSwigger's BApp Store lists CrypticBurp, a Burp Suite extension by Mansoor Ahmad and Alex Thines, at version 1.1 and last updated 08 October 2026. It handles application-layer encryption layered on top of TLS, intercepting requests and responses,...
PortSwigger released Burp Suite Professional and Community 2026.9.2 as a stable build on Friday, 9 October 2026 at 13:11 UTC, with desktop downloads for Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release upgrades...
PortSwigger released Burp Suite Professional / Community 2026.10 on Monday, 12 October 2026 at 12:01 UTC, reintroducing support for HTTP Digest authentication so testers can assess applications using that method without an older Burp version or a...
PortSwigger shipped a set of updates to Burp AT, its agentic testing tool launched at Black Hat USA, based on user feedback. The changes add custom user-defined skills selectable via a slash command, a /goal command that keeps the agent working toward an...
A third-party Burp Suite extension called Image Location and Privacy Scanner passively scans HTTP responses for embedded images and raises issues when those images contain GPS location metadata or other potentially sensitive personal information. The...
ActiveScan++, a Burp Suite extension by James Kettle of PortSwigger at version 2.0.14, extends active and passive scanning to identify application behavior that may interest advanced testers, with a design goal of minimal network overhead. The listing...
PortSwigger released detection for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) within hours of disclosure, starting with passive checks through a Java-based custom scan check, a DAST-compatible BCheck, and an update to James Kettle's ActiveScan++...
PortSwigger released Burp Suite Professional / Community 2026.9.3 on Monday, 26 October 2026, which lets users send requests and responses to Burp AT from Repeater, Intruder, Logger, Organizer, Burp Search results, and messages sent by Burp Scanner. The...
PortSwigger released Burp Suite Professional/Community 2026.10.1 on Monday, 26 October 2026, which lets users send requests and responses to Burp AT from Repeater, Intruder, Logger, Organizer, Burp Search results, and messages sent by Burp Scanner. The...
PortSwigger released Burp Suite DAST 2026.10.2 on 27 October 2026, adding ServiceNow ticketing that raises, links, and automates tickets from issues based on severity, confidence, and site. The release also expands SOAP API scan coverage to nested values,...
PortSwigger researcher Gareth Heyes tested eight popular SVG sanitizers and bypassed six of them, including mattkrick/sanitize-svg, Borewit/svg-sanitizer, bgalek/safe-svg, alnorris/SVG-Sanitizer, cloudflare/svg-hush and jams2/py-svg-hush. The bypasses...
PortSwigger released Burp Suite DAST 2026.10.3 on 29 October 2026, adding the ability to scan APIs from Burp XML and HAR files, where each request in the file becomes an endpoint that can be reviewed and enabled or disabled like Postman requests. The...
PortSwigger's BApp Store lists Click-Jackalope, a Burp extension by Matthew Prater, version 1.0.0, that generates clickjacking proof-of-concept pages from target URLs and inspects response headers for frame-defense directives. It adds a dedicated tab and...
PortSwigger's BApp Store lists a Burp extension, version 0.0.4 from the Dradis Core team, that connects Burp Scanner to the Dradis Framework, a collaboration and reporting tool that combines output from 20 different scanners with manual findings and...
PortSwigger released Burp Suite DAST 2026.10.4 on 3 November 2026, adding the ability to raise and track Burp Suite DAST issues as GitHub issues. The integration connects to GitHub.com, GitHub Enterprise Server, or GitHub Enterprise Cloud with data...
PortSwigger released Burp Suite DAST 2026.11 on Wednesday, 4 November 2026, a maintenance release that speeds up the site page and fixes bugs in retests and crawling. The retest fix makes a passive issue on a crawled page, such as a missing X-Frame-Options...
PortSwigger Research released a new Burp Scanner check for HTTP Request Header Injection and a Burp AT skill that automates its CRLF-Powered Desync methodology, escalating header injection to a desync and then to an open-redirect exploit in a single...
PortSwigger released a Burp Suite extension, version 1.4.0, that exposes Burp functionality through a Model Context Protocol server so AI assistants can perform security testing tasks, analyze traffic, and interact with Burp tools programmatically. The...
PortSwigger researcher Gareth Heyes built a Burp AT skill that reads a Content-Security-Policy header, checks allowed script hosts against a dataset of more than 350 known CSP bypass gadgets from cspbypass.com, and builds a proof of concept that...
PortSwigger released Burp Suite DAST 2026.11.1 on 12 November 2026, adding a beta GraphQL API endpoint at /graphql/beta while restricting /graphql/v1 to the public schema, so requests using undocumented or Beta fields now fail there with a validation...
PortSwigger's BApp Store lists a Burp Suite extension called gRPC-Web Coder, version 2.0.0, by Amin Nasiri, last updated 12 November 2026, that decodes and re-encodes gRPC-Web request and response bodies in the message editor without the target's .proto...