A complete, evidence-backed account of a security review of Burp Suite Professional
2026.10.1 for Linux: the desktop client, its installer, and the licensing system.
The headline finding is that strong licence verification does not, on its own, protect
the paid/unpaid decision at runtime — and that the installer trusts a plain-text record
of previous installations when choosing which Java runtime to execute.
Every claim on the site traces to something retained — a log from a running instance, a
decompiled class, a decrypted string, or a script that reproduces the result.