ZAP by Checkmarx
LightNews LightNews
banner
zaproxy.org
ZAP by Checkmarx
@zaproxy.org
1.2K followers 3 following 92 posts
The Worlds Most Popular Web App Scanner.
Posts Replies Media Videos
zaproxy.org
Blog post: www.zaproxy.org/blog/2026-11...
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
ZAP Updates - October 2026
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
www.zaproxy.org
November 2, 2026 at 12:46 PM
zaproxy.org
The ZAP Network add-on has been updated to use the latest Brotli library.
We do not believe that Java is affected by CVE-2026-111497 but we still recommend that you update this add-on from the ZAP Marketplace ASAP.
We have also regenerated the stable Docker image.
#zaproxy #appsec
October 26, 2026 at 2:27 PM
zaproxy.org
Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP
PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request.
www.zaproxy.org/blog/2026-10...
#zaproxy #php2shell
Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP
PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request.
www.zaproxy.org
October 22, 2026 at 3:44 PM
zaproxy.org
The ZAP Browser Extension (version 0.3.0) has a new Script Viewer. You can now see the Zest script you are recording as you record it, then edit it, replay it step by step, and load and save it, all without leaving the browser.
www.zaproxy.org/blog/2026-10...
#zaproxy #appsec
View, edit, and replay your recorded Zest scripts
The ZAP Browser Extension (version 0.3.0) has a new Script Viewer. You can now see the Zest script you are recording as you record it, then edit it, replay it step by step, and load and save it, all w...
www.zaproxy.org
October 21, 2026 at 11:35 AM
zaproxy.org
LLMs have changed how software is developed - read about how we’re handling that change in the ZAP project:
www.zaproxy.org/blog/2026-10...
#zaproxy #oss #llm
Developing ZAP in the LLM Age
LLMs have made it much easier to generate code, which changes the balance of how open source projects like ZAP are developed. We are not closing the door on new contributors - ZAP has always been a co...
www.zaproxy.org
October 13, 2026 at 2:51 PM
zaproxy.org
Initial support for handling OAuth2.0 is now available.

Details on the ZAP Blog: www.zaproxy.org/blog/2026-10...

Lots of other add-ons have also been updated, so update ZAP now!
#appsec #zaproxy
Initial OAuth2.0 support
The Authentication Helper add-on now ships with an OAuth2 authentication method for the non-interactive grant types: client_credentials and password. This is an early release and we want your feedback...
www.zaproxy.org
October 8, 2026 at 2:42 PM
zaproxy.org
ZAP Updates for September:
The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP’s nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.
www.zaproxy.org/blog/2026-10...
#zaproxy #appsec
ZAP Updates - September 2026
The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP’s nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.
www.zaproxy.org
October 1, 2026 at 2:27 PM
zaproxy.org
The latest weekly release does not include the AJAX Spider and DOM XSS add-ons.
You can install them via the Marketplace as usual, but we recommend you using the Client Spider and OWASP PTK add-ons instead.
For more details see www.zaproxy.org/blog/2026-09...
#zaproxy #appsec
ZAP Updates - August 2026
We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.
www.zaproxy.org
September 15, 2026 at 10:13 AM
zaproxy.org
ZAP updates for August.
We’re removing 2 add-ons from the nightly and weekly releases, so if you use those then make sure you read it to understand the implications.
www.zaproxy.org/blog/2026-09...
#zaproxy #appsec
ZAP Updates - August 2026
We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.
www.zaproxy.org
September 8, 2026 at 1:39 PM
Reposted by ZAP by Checkmarx
kingthorin.bsky.social
What's this? @zaproxy.org fuzzer update released this morning, with work from yours truly.

#PenTest #WebAppSec #BugBountyTips
August 7, 2026 at 2:18 PM
zaproxy.org
Introducing ZAP LLM Support:
www.zaproxy.org/blog/2026-08...
A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice.
#zaproxy #appsec
The ZAP LLM Support Add-on
A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice, powering an interactive chat panel and AI-assisted features in the OpenAPI and Alert Filters add-ons.
www.zaproxy.org
August 7, 2026 at 2:40 PM
zaproxy.org
www.zaproxy.org/blog/2026-08... - a huge increase in the number of times ZAP was started, and we now recommend using the Client Spider instead of the AJAX Spider
#zaproxy #appsec
ZAP Updates - July 2026
ZAP was started more than 13 million times in July, another big jump, and the Client Spider officially became our recommended option for crawling modern web apps.
www.zaproxy.org
August 6, 2026 at 2:27 PM
zaproxy.org
It has been 3 years since ZAP left OWASP.
Update your docs!
www.zaproxy.org/docs/nowaspz...
#zaproxy #owasp
N⛔WASP ZAP
ZAP is no longer an OWASP project, and has not been one since August 2023. So if you see ZAP referred to as “OWASP ZAP” anywhere, that reference is out of date - the correct name is just ZAP, or ZAP b...
www.zaproxy.org
July 31, 2026 at 9:13 AM
zaproxy.org
Big announcement!
We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider.
More details in the blog post:
www.zaproxy.org/blog/2026-07...
#zaproxy #appsec
Use the Client Spider for Modern Web Apps
We now recommend the Client Spider over the AJAX Spider for crawling modern web applications. It finds more endpoints, scales much better vs large apps, and unlocks PTK’s passive coverage for free.
www.zaproxy.org
July 6, 2026 at 3:27 PM
zaproxy.org
ZAP Blog: June Updates
www.zaproxy.org/blog/2026-07...
More PTK integration, lots of Client Spider improvements, and much more..
#zaproxy #appsec
ZAP Updates - June 2026
In June the OWASP PTK add-on graduated to beta with its integration now properly matching ZAP’s architecture, a security advisory was issued and patched for the Viewstate add-on, and the Client Spider...
www.zaproxy.org
July 1, 2026 at 12:01 PM
zaproxy.org
Blog Post: Even More OWASP PTK Integration with ZAP.
SAST and IAST passive scanning out of the box with the Client Spider, and the active rule is now enabled by default.
www.zaproxy.org/blog/2026-06...
#zaproxy #owaspptk #appsec
Even More OWASP PTK Integration with ZAP
The PTK add-on graduates to beta, the active scan rule is on by default, recommended rule defaults reduce noise by avoiding duplicate findings, and a new Engines tab gives you fine-grained control ove...
www.zaproxy.org
June 29, 2026 at 4:55 PM
zaproxy.org
An Insecure Java Deserialization vulnerability has been reported in a ZAP add-on via Neo by ProjectDiscovery.

Update your ZAP add-ons now, and definitely update from older versions of ZAP.

For more details see: www.zaproxy.org/blog/2026-06...
Java Deserialization Vulnerability in ZAP Viewstate Add-on
A Java Deserialization Vulnerability has been found in the ZAP Viewstate Add-on. Update your ZAP add-ons now, and if you are on an older version of ZAP then update that ASAP.
www.zaproxy.org
June 24, 2026 at 2:52 PM
zaproxy.org
ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner.
Check out the dramatic improvement in the scores vs Google Firing Range!
www.zaproxy.org/blog/2026-06...
#zaproxy #owaspptk #appsec
Automating OWASP PTK with ZAP (Phase 2)
ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. And there are still more changes planned, but the results against Firing Range have been dramatic!
www.zaproxy.org
June 5, 2026 at 10:31 AM
zaproxy.org
In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on.
www.zaproxy.org/blog/2026-06...
#zaproxy #appsec
ZAP Updates - May 2026
In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on.
www.zaproxy.org
June 2, 2026 at 1:19 PM
zaproxy.org
ZAP can now scan MCP Servers, in the Desktop, Automation Framework and in a new GitHub Action.
Read all about it on the blog:
www.zaproxy.org/blog/2026-05...
#zaproxy #appsec #mcp
Scanning MCP Servers with ZAP
ZAP can now scan MCP (Model Context Protocol) servers as a first-class target. Import an MCP server from the ZAP desktop or the Automation Framework, or run the new action-mcp-scan GitHub Action to sc...
www.zaproxy.org
May 21, 2026 at 4:49 PM
zaproxy.org
Blog: Automating OWASP PTK with ZAP (Phase 1)
You can now automate OWASP pentestkit using ZAP
www.zaproxy.org/blog/2026-05...
#zaproxy #owasp-ptk #appsec
Automating OWASP PTK with ZAP (Phase 1)
ZAP’s Automation Framework can now drive OWASP PTK scans using the Client Spider. This is an early release - we want you to try it and give us feedback while we work toward deeper integration with ZAP...
www.zaproxy.org
May 6, 2026 at 4:17 PM
zaproxy.org
Blog: Vibe coding security fixes.
www.zaproxy.org/blog/2026-04...
Learn how ZAP can help you make your vibe coded projects more secure.
#zaproxy #vibecoding #appsec
Vibe Coding Security Fixes
ZAP now has a “Generate Fix Prompt” option that copies everything an LLM needs to fix a vulnerability straight to your clipboard. Also: ZAP was run 9.5 million times in March. Vibe coding, anyone?
www.zaproxy.org
April 15, 2026 at 4:33 PM
zaproxy.org
Guest Blog: www.zaproxy.org/blog/2026-04...
Learn how to integrate ZAP with KRO in a Kubernetes cluster to scan the security of each new deployment.
℅ Trevor Mountney
#zaproxy #kubernetes #appsec
Use ZAP with KRO in Kubernetes
Learn how to integrate ZAP with KRO in a Kubernetes cluster to scan the security of each new deployment.
www.zaproxy.org
April 14, 2026 at 3:11 PM
zaproxy.org
Blog: ZAP Updates for March:
www.zaproxy.org/blog/2026-04...
ZAP was started 9.5 MILLION times .. and we announced significant collaborations with other open source projects
#zaproxy #appsec
ZAP Updates - March 2026
ZAP was started nearly 9.5 million times in March, published integrations with 3 other open source projects, and released the first of many AI related features.
www.zaproxy.org
April 3, 2026 at 10:01 AM
zaproxy.org
Introducing the ZAP MCP Server www.zaproxy.org/blog/2026-04...
#zaproxy #mcp #ai #appsec
The ZAP MCP Server
Connect AI assistants like Claude and ChatGPT to ZAP via the Model Context Protocol. Start scans, read alerts, and explore your application—all through natural conversation.
www.zaproxy.org
April 2, 2026 at 12:16 PM