PortSwigger researcher James Kettle unveiled the HTTP Terminator, an autonomous AI system that invented novel HTTP desync attack techniques and compromised banks, security solutions, and government in…
PortSwigger researcher James Kettle built an AI system called HTTP Terminator that, with human guidance, identified 700 vulnerable websites to HTTP request smuggling, stole a live API key from a bank,…
PortSwigger researcher James Kettle demonstrated HTTP Terminator at Black Hat 2026, an AI system that generates novel attack techniques, producing 30,000 attack vectors from 138 protocol RFCs and test…
A security researcher discovered a stored cross-site scripting (XSS) vulnerability in a business bank's AI chatbot that could compromise customer banking sessions via malicious payloads in uploaded PD…
PortSwigger researcher Gareth Heyes presented proof-of-concept CSS attack chains at Black Hat USA 2026 that affect Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, according to The Hac…
Server-side request forgery (SSRF) is a critical security vulnerability that will become more prevalent in the agentic-AI era, according to a guide aimed at LLM practitioners. The vulnerability was hi…
Bug bounty hunters returning in 2026 must adopt AI as a core tool, as top hunters now use it for scale and speed, though human expertise remains critical. The most valuable vulnerabilities remain high…
Help Net Security's July 31, 2026 roundup highlights new infosec products from BlackCloak, Contrast Security, Dropzone AI, PortSwigger, Realm Security, Reco, Root Evidence, and ZeroFox. BlackCloak ext…
PortSwigger has announced the public beta of Burp AT, a new addition to Burp Suite that brings agentic AI to professional penetration testing. The tool enables testers to delegate defined investigativ…
PortSwigger launched Burp AT in public beta on July 27, 2026, for Burp Suite Professional users, adding AI agents that can pursue testing goals using Burp's tools and project context while scope and a…
PortSwigger's Burp Suite faces growing competition from alternatives like Aikido Security, Caido, ZAP, and Invicti as teams demand DAST that runs continuously in CI/CD, AI-powered pentesting, and visi…
A security researcher warns that coding models should be treated as executable code, as they can generate malicious tool calls that exfiltrate environment variables or introduce subtle vulnerabilities…