Zed Attack Proxy

Official announcements (low vol) for ZAP by @Checkmarx - the worlds most popular web app scanner. Free and open source.

[Zed Attack Proxy @zaproxy]

Want to learn more about ZAP? The latest tutorial videos are all linked off https://t.co/MuWkX4eFaz - we're adding to them all of the time.

[Zed Attack Proxy @zaproxy]

Blog: Intercepting all Android traffic with ZAP
https://t.co/2nOSUkldpV
c/o zaptun - a community add-on by David Araújo
#zaproxy #appsec #android

[Zed Attack Proxy @zaproxy]

Blog: Intercepting all Android traffic with ZAP
https://t.co/2nOSUkldpV
c/o zaptun - a community add-on by David Araújo
#zaproxy #appsec #android

[Zed Attack Proxy @zaproxy]

Authenticating to modern web apps is hard. The Authentication Helper add-on now has an AI Assisted Authentication method which uses an LLM to work out how to log in, then turns that into a fast, repeatable Client Script.
https://t.co/v4kV6aa9uN

[Zed Attack Proxy @zaproxy]

Blog post: https://t.co/MdsrJxhPMv
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec

[Zed Attack Proxy @zaproxy]

All ZAP versions from 2.14 use the old Brotli library, but as usual only the latest version of ZAP will receive the patch.
We strongly advise those of you running old versions of ZAP to update to 2.17.0

[Zed Attack Proxy @zaproxy]

The ZAP Network add-on has been updated to use the latest Brotli library.
We do not believe that Java is affected by CVE-2026-111497 but we still recommend that you update this add-on from the ZAP Marketplace ASAP.
We have also regenerated the stable Docker image.
#zaproxy

[Zed Attack Proxy @zaproxy]

Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP
PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request.
https://t.co/9G4DtEhMM6
#php2shell

[Zed Attack Proxy @zaproxy]

The ZAP Browser Extension (version 0.3.0) has a new Script Viewer. You can now see the Zest script you are recording as you record it, then edit it, replay it step by step, and load and save it, all without leaving the browser.
https://t.co/TtifWJ7Z8l
#zaproxy #appsec

[Zed Attack Proxy @zaproxy]

LLMs have changed how software is developed - read about how we’re handling that change in the ZAP project:
https://t.co/j3OydrgmdU
#zaproxy #oss #llm

[Zed Attack Proxy @zaproxy]

Initial support for handling OAuth2.0 is now available.

Details on the ZAP Blog: https://t.co/cMiVTlTPnA

Lots of other add-ons have also been updated, so update ZAP now!
#appsec #zaproxy

[Zed Attack Proxy @zaproxy]

Big set of add-on releases this morning

#zaproxy #dast #AppSec #WebAppSec

[Zed Attack Proxy @zaproxy]

ZAP Updates for September:
The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP's nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.
https://t.co/4FdsQrolOT
#zaproxy #appsec

[Zed Attack Proxy @zaproxy]

The latest weekly release does not include the AJAX Spider and DOM XSS add-ons.
You can install them via the Marketplace as usual, but we recommend you using the Client Spider and OWASP PTK add-ons instead.
For more details see https://t.co/UOAO6sUqMU
#zaproxy #appsec

[Zed Attack Proxy @zaproxy]

ZAP updates for August.
We’re removing 2 add-ons from the nightly and weekly releases, so if you use those then make sure you read it to understand the implications.
https://t.co/UOAO6sUqMU
#zaproxy #appsec

[Zed Attack Proxy @zaproxy]

ZAP's Technology Detection add-on got a new icon in today's release.

[Zed Attack Proxy @zaproxy]

Introducing ZAP LLM Support:
https://t.co/lUqJMyR6nq
A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice.
#zaproxy #appsec

[Zed Attack Proxy @zaproxy]

https://t.co/DScw60NUhU - a huge increase in the number of times ZAP was started, and we now recommend using the Client Spider instead of the AJAX Spider
#zaproxy #appsec

[Zed Attack Proxy @zaproxy]

It has been 3 years since ZAP left @owasp
Update your docs!
https://t.co/qxtINZOyBT

[Zed Attack Proxy @zaproxy]

Big announcement!
We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider.
More details in the blog post:
https://t.co/uO9my5vI5L
#zaproxy #appsec

[Zed Attack Proxy @zaproxy]

Big announcement!
We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider.
More details in the blog post:
https://t.co/uO9my5vI5L
#zaproxy #appsec