Zed Attack Proxy (@zaproxy) header
Zed Attack Proxy (@zaproxy) profile picture

Zed Attack Proxy

@zaproxy

Official announcements (low vol) for ZAP by @Checkmarx - the worlds most popular web app scanner. Free and open source. https://nitter.cf/t.co/pxO8zZ6usH

zaproxy.org
Joined June 2011
  • Tweets986
  • Following5
  • Followers15.3K
71Media
Photo by Zed Attack Proxy (@zaproxy)Photo by Zed Attack Proxy (@zaproxy)Photo by Zed Attack Proxy (@zaproxy)Photo by Zed Attack Proxy (@zaproxy)Photo by Zed Attack Proxy (@zaproxy)Photo by Zed Attack Proxy (@zaproxy)
Want to learn more about ZAP? The latest tutorial videos are all linked off zaproxy.org/videos/ - we're adding to them all of the time.
6
46
1
98
The ZAP Network add-on has been updated to use the latest Brotli library. We do not believe that Java is affected by CVE-2026-111497 but we still recommend that you update this add-on from the ZAP Marketplace ASAP. We have also regenerated the stable Docker image. #zaproxy
2
6
1
15
1,305
All ZAP versions from 2.14 use the old Brotli library, but as usual only the latest version of ZAP will receive the patch. We strongly advise those of you running old versions of ZAP to update to 2.17.0
2
3
216
Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request. zaproxy.org/blog/2026-10-22-… #php2shell
Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP

Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP

PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request.

zaproxy.org
2
10
1
19
1,007
The ZAP Browser Extension (version 0.3.0) has a new Script Viewer. You can now see the Zest script you are recording as you record it, then edit it, replay it step by step, and load and save it, all without leaving the browser. zaproxy.org/blog/2026-10-21-… #zaproxy #appsec
View, edit, and replay your recorded Zest scripts

View, edit, and replay your recorded Zest scripts

The ZAP Browser Extension (version 0.3.0) has a new Script Viewer. You can now see the Zest script you are recording as you record it, then edit it, replay it step by step, and load and save it, all...

zaproxy.org
1
7
8
712
LLMs have changed how software is developed - read about how we’re handling that change in the ZAP project: zaproxy.org/blog/2026-10-13-… #zaproxy #oss #llm
Developing ZAP in the LLM Age

Developing ZAP in the LLM Age

LLMs have made it much easier to generate code, which changes the balance of how open source projects like ZAP are developed. We are not closing the door on new contributors - ZAP has always been a...

zaproxy.org
5
11
731
Initial support for handling OAuth2.0 is now available. Details on the ZAP Blog: zaproxy.org/blog/2026-10-08-… Lots of other add-ons have also been updated, so update ZAP now! #appsec #zaproxy
Initial OAuth2.0 support

Initial OAuth2.0 support

The Authentication Helper add-on now ships with an OAuth2 authentication method for the non-interactive grant types: client_credentials and password. This is an early release and we want your...

zaproxy.org
7
10
603
Big set of add-on releases this morning #zaproxy #dast #AppSec #WebAppSec
Image from Zed Attack Proxy (@zaproxy)
8
11
690
ZAP Updates for September: The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP's nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag. zaproxy.org/blog/2026-10-01-… #zaproxy #appsec
ZAP Updates - September 2026

ZAP Updates - September 2026

The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP’s nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.

zaproxy.org
1
5
10
745
The latest weekly release does not include the AJAX Spider and DOM XSS add-ons. You can install them via the Marketplace as usual, but we recommend you using the Client Spider and OWASP PTK add-ons instead. For more details see zaproxy.org/blog/2026-09-08-… #zaproxy #appsec
ZAP Updates - August 2026

ZAP Updates - August 2026

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

zaproxy.org
7
10
597
ZAP updates for August. We’re removing 2 add-ons from the nightly and weekly releases, so if you use those then make sure you read it to understand the implications. zaproxy.org/blog/2026-09-08-… #zaproxy #appsec
ZAP Updates - August 2026

ZAP Updates - August 2026

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

zaproxy.org
1
6
8
521
ZAP's Technology Detection add-on got a new icon in today's release.
1
1
5
1,056
Introducing ZAP LLM Support: zaproxy.org/blog/2026-08-07-… A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice. #zaproxy #appsec
The ZAP LLM Support Add-on

The ZAP LLM Support Add-on

A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice, powering an interactive chat panel and AI-assisted features in the OpenAPI and Alert Filters add-ons.

zaproxy.org
8
17
1,303
zaproxy.org/blog/2026-08-06-… - a huge increase in the number of times ZAP was started, and we now recommend using the Client Spider instead of the AJAX Spider #zaproxy #appsec
ZAP Updates - July 2026

ZAP Updates - July 2026

ZAP was started more than 13 million times in July, another big jump, and the Client Spider officially became our recommended option for crawling modern web apps.

zaproxy.org
4
1
13
1,378
It has been 3 years since ZAP left @owasp Update your docs! zaproxy.org/docs/nowaspzap/
N⛔WASP ZAP

N⛔WASP ZAP

ZAP is no longer an OWASP project, and has not been one since August 2023. So if you see ZAP referred to as “OWASP ZAP” anywhere, that reference is out of date - the correct name is just ZAP, or ZAP...

zaproxy.org
4
16
1,273
Zed Attack Proxy retweeted
Zed Attack Proxy (@zaproxy) profile picture
Zed Attack Proxy@zaproxyJul 6
Big announcement! We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider. More details in the blog post: zaproxy.org/blog/2026-07-06-… #zaproxy #appsec
Use the Client Spider for Modern Web Apps

Use the Client Spider for Modern Web Apps

We now recommend the Client Spider over the AJAX Spider for crawling modern web applications. It finds more endpoints, scales much better vs large apps, and unlocks PTK’s passive coverage for free.

zaproxy.org
4
10
852
Big announcement! We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider. More details in the blog post: zaproxy.org/blog/2026-07-06-… #zaproxy #appsec
Use the Client Spider for Modern Web Apps

Use the Client Spider for Modern Web Apps

We now recommend the Client Spider over the AJAX Spider for crawling modern web applications. It finds more endpoints, scales much better vs large apps, and unlocks PTK’s passive coverage for free.

zaproxy.org
4
10
852
ZAP Blog: June Updates zaproxy.org/blog/2026-07-01-… More PTK integration, lots of Client Spider improvements, and much more.. #zaproxy #appsec
ZAP Updates - June 2026

ZAP Updates - June 2026

In June the OWASP PTK add-on graduated to beta with its integration now properly matching ZAP’s architecture, a security advisory was issued and patched for the Viewstate add-on, and the Client...

zaproxy.org
4
6
1,014
Blog Post: Even More OWASP PTK Integration with ZAP. SAST and IAST passive scanning out of the box with the Client Spider, and the active rule is now enabled by default. zaproxy.org/blog/2026-06-29-… @pentestkit #zaproxy #owaspptk #appsec
Even More OWASP PTK Integration with ZAP

Even More OWASP PTK Integration with ZAP

The PTK add-on graduates to beta, the active scan rule is on by default, recommended rule defaults reduce noise by avoiding duplicate findings, and a new Engines tab gives you fine-grained control...

zaproxy.org
4
5
672
An Insecure Java Deserialization vulnerability has been reported in a ZAP add-on via @neo_ai_engineer Update your ZAP add-ons now, and definitely update from older versions of ZAP. For more details see: zaproxy.org/blog/2026-06-24-…

Java Deserialization Vulnerability in ZAP Viewstate Add-on

A Java Deserialization Vulnerability has been found in the ZAP Viewstate Add-on. Update your ZAP add-ons now, and if you are on an older version of ZAP then update that ASAP.

zaproxy.org
5
1
14
1,264
ZAP now has a dedicated OWASP PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. Check out the dramatic improvement in the scores vs Google Firing Range! zaproxy.org/blog/2026-06-05-… #zaproxy #owaspptk #appsec
Automating OWASP PTK with ZAP (Phase 2)

Automating OWASP PTK with ZAP (Phase 2)

ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. And there are still more changes planned, but the results against Firing Range have been dramatic!

zaproxy.org
6
5
2,034
Load more