ZAP by Checkmarx

ZAP by Checkmarx

@zaproxy.org

The Worlds Most Popular Web App Scanner.

1.1K followers3 following91 posts

ZAP by Checkmarx
@zaproxy.org

The ZAP Network add-on has been updated to use the latest Brotli library. We do not believe that Java is affected by CVE-2026-111497 but we still recommend that you update this add-on from the ZAP Marketplace ASAP. We have also regenerated the stable Docker image. #zaproxy #appsec

ZAP by Checkmarx
@zaproxy.org

All ZAP versions from 2.14 use the old Brotli library, but as usual only the latest version of ZAP will receive the patch. We strongly advise those of you running old versions of ZAP to update to 2.17.0

ZAP by Checkmarx
@zaproxy.org

Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request. www.zaproxy.org/blog/2026-10... #zaproxy #php2shell

zaproxy.orgDetecting PHP2Shell and Other PHP Vulnerabilities with ZAPPHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request.
ZAP by Checkmarx
@zaproxy.org

The ZAP Browser Extension (version 0.3.0) has a new Script Viewer. You can now see the Zest script you are recording as you record it, then edit it, replay it step by step, and load and save it, all without leaving the browser. www.zaproxy.org/blog/2026-10... #zaproxy #appsec

zaproxy.orgView, edit, and replay your recorded Zest scriptsThe ZAP Browser Extension (version 0.3.0) has a new Script Viewer. You can now see the Zest script you are recording as you record it, then edit it, replay it step by step, and load and save it, all w...
ZAP by Checkmarx
@zaproxy.org

ZAP Updates for September: The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP’s nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag. www.zaproxy.org/blog/2026-10... #zaproxy #appsec

zaproxy.orgZAP Updates - September 2026The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP’s nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.
ZAP by Checkmarx
@zaproxy.org

The latest weekly release does not include the AJAX Spider and DOM XSS add-ons. You can install them via the Marketplace as usual, but we recommend you using the Client Spider and OWASP PTK add-ons instead. For more details see www.zaproxy.org/blog/2026-09... #zaproxy #appsec

zaproxy.orgZAP Updates - August 2026We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.
ZAP by Checkmarx
@zaproxy.org

Blog Post: Even More OWASP PTK Integration with ZAP. SAST and IAST passive scanning out of the box with the Client Spider, and the active rule is now enabled by default. www.zaproxy.org/blog/2026-06... #zaproxy #owaspptk #appsec

zaproxy.orgEven More OWASP PTK Integration with ZAPThe PTK add-on graduates to beta, the active scan rule is on by default, recommended rule defaults reduce noise by avoiding duplicate findings, and a new Engines tab gives you fine-grained control ove...
ZAP by Checkmarx
@zaproxy.org

An Insecure Java Deserialization vulnerability has been reported in a ZAP add-on via Neo by ProjectDiscovery. Update your ZAP add-ons now, and definitely update from older versions of ZAP. For more details see: www.zaproxy.org/blog/2026-06...

zaproxy.orgJava Deserialization Vulnerability in ZAP Viewstate Add-onA Java Deserialization Vulnerability has been found in the ZAP Viewstate Add-on. Update your ZAP add-ons now, and if you are on an older version of ZAP then update that ASAP.
ZAP by Checkmarx
@zaproxy.org

ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. Check out the dramatic improvement in the scores vs Google Firing Range! www.zaproxy.org/blog/2026-06... #zaproxy #owaspptk #appsec

zaproxy.orgAutomating OWASP PTK with ZAP (Phase 2)ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. And there are still more changes planned, but the results against Firing Range have been dramatic!
ZAP by Checkmarx
@zaproxy.org

This is huge! www.zaproxy.org/blog/2026-04... OWASP PTK massively increases ZAP’s browser side testing capabilities .. and automation is up next! Many thanks to Denis Podgurskii for this great integration. #zaproxy #owasp #appsec

zaproxy.orgOWASP PTK Findings as ZAP Alerts (Juice Shop Walkthrough)OWASP PTK 9.8.0 and the ZAP OWASP PTK add-on 0.3.0 now let ZAP display OWASP PTK findings directly as ZAP Alerts. This post shows how to install the add-on, choose which PTK rules to run (SAST / IAST ...
ZAP by Checkmarx
@zaproxy.org

New ZAP Blog Post: www.zaproxy.org/blog/2026-03... This post describes an approach that uses static analysis findings to guide ZAP’s active scans toward the most relevant endpoints. The result is a faster scanning mode suited for CI/CD pipelines. Thanks to the Seqra Team! #zaproxy #appsec

zaproxy.orgGuided ZAP Scans: Faster CI/CD Feedback Using Static AnalysisThis post describes an approach that uses static analysis findings to guide ZAP’s active scans toward the most relevant endpoints. The result is a faster scanning mode suited for CI/CD pipelines, buil...
ZAP by Checkmarx
@zaproxy.org

Combine the Encode/Decode/Hash add-on with CyberChef operations in ZAP Encode/Decode Scripts for flexible encoding, decoding, and hashing in your testing workflow. www.zaproxy.org/blog/2026-02... #zaproxy #appsec #cyberchef

zaproxy.orgUsing ZAP's Encode/Decode/Hash Add-on with CyberChef via Encode/Decode ScriptsCombine the Encode/Decode/Hash add-on with CyberChef operations in ZAP Encode/Decode Scripts for flexible encoding, decoding, and hashing in your testing workflow.
ZAP by Checkmarx
@zaproxy.org

The latest version of the retirejs add-on includes a test for CVE-2025-66478 which is marked as "critical" so update now to detect this vulnerability.

ZAP by Checkmarx
@zaproxy.org

We have just published a new ZAP weekly release, to fix a bug which could cause invalid JSON reports to be generated. If you are using the most recent weekly we recommend you update ASAP.