N⛔WASP ZAP

ZAP is no longer an OWASP project, and has not been one since August 2023. So if you see ZAP referred to as “OWASP ZAP” anywhere, that reference is out of date - the correct name is just ZAP, or ZAP b...

zaproxy.org

Use the Client Spider for Modern Web Apps

We now recommend the Client Spider over the AJAX Spider for crawling modern web applications. It finds more endpoints, scales much better vs large apps, and unlocks PTK’s passive coverage for free.

zaproxy.org

ZAP Updates - June 2026

In June the OWASP PTK add-on graduated to beta with its integration now properly matching ZAP’s architecture, a security advisory was issued and patched for the Viewstate add-on, and the Client Spider...

zaproxy.org

Even More OWASP PTK Integration with ZAP

The PTK add-on graduates to beta, the active scan rule is on by default, recommended rule defaults reduce noise by avoiding duplicate findings, and a new Engines tab gives you fine-grained control ove...

zaproxy.org

Java Deserialization Vulnerability in ZAP Viewstate Add-on

A Java Deserialization Vulnerability has been found in the ZAP Viewstate Add-on. Update your ZAP add-ons now, and if you are on an older version of ZAP then update that ASAP.

zaproxy.org

Automating OWASP PTK with ZAP (Phase 2)

ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. And there are still more changes planned, but the results against Firing Range have been dramatic!

zaproxy.org

ZAP Updates - May 2026

In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on.

zaproxy.org

Scanning MCP Servers with ZAP

ZAP can now scan MCP (Model Context Protocol) servers as a first-class target. Import an MCP server from the ZAP desktop or the Automation Framework, or run the new action-mcp-scan GitHub Action to sc...

zaproxy.org

Automating OWASP PTK with ZAP (Phase 1)

ZAP’s Automation Framework can now drive OWASP PTK scans using the Client Spider. This is an early release - we want you to try it and give us feedback while we work toward deeper integration with ZAP...

zaproxy.org

Vibe Coding Security Fixes

ZAP now has a “Generate Fix Prompt” option that copies everything an LLM needs to fix a vulnerability straight to your clipboard. Also: ZAP was run 9.5 million times in March. Vibe coding, anyone?

zaproxy.org

Use ZAP with KRO in Kubernetes

Learn how to integrate ZAP with KRO in a Kubernetes cluster to scan the security of each new deployment.

zaproxy.org

ZAP Updates - March 2026

ZAP was started nearly 9.5 million times in March, published integrations with 3 other open source projects, and released the first of many AI related features.

zaproxy.org

The ZAP MCP Server

Connect AI assistants like Claude and ChatGPT to ZAP via the Model Context Protocol. Start scans, read alerts, and explore your application—all through natural conversation.

zaproxy.org

OWASP PTK Findings as ZAP Alerts (Juice Shop Walkthrough)

OWASP PTK 9.8.0 and the ZAP OWASP PTK add-on 0.3.0 now let ZAP display OWASP PTK findings directly as ZAP Alerts. This post shows how to install the add-on, choose which PTK rules to run (SAST / IAST ...

zaproxy.org

Guided ZAP Scans: Faster CI/CD Feedback Using Static Analysis

This post describes an approach that uses static analysis findings to guide ZAP’s active scans toward the most relevant endpoints. The result is a faster scanning mode suited for CI/CD pipelines, buil...

zaproxy.org

Introducing DeepViolet

Introducing DeepViolet: The Engine Behind ZAP’s New TLS Analysis

zaproxy.org

ZAP Updates - February 2026

February was another busy month for the ZAP project, with improvements across browser automation, GraphQL and the Encode/Decode/Hash add-on.

zaproxy.org

Custom Browsers and Preferences

You can now add custom browsers to ZAP and manage any browser preferences.

zaproxy.org

Using ZAP's Encode/Decode/Hash Add-on with CyberChef via Encode/Decode Scripts

Combine the Encode/Decode/Hash add-on with CyberChef operations in ZAP Encode/Decode Scripts for flexible encoding, decoding, and hashing in your testing workflow.

zaproxy.org

Detecting Circular Type References in GraphQL Schemas

ZAP can now detect cycles in GraphQL schemas that could lead to denial of service attacks.

zaproxy.org

ZAP Updates - 2025 Highlights and Plans for 2026

Highlights of 2025 and our initial plans for 2026, including more 3rd Party tool integrations, enhanced exploring and, yes, AI integration!

zaproxy.org

OWASP PTK Integration with ZAP

OWASP PTK is now pre-installed in the browsers launched by ZAP (Chrome, Edge and Firefox). This post shows how to run PTK’s DAST, IAST, SAST, and SCA inside the same authenticated session you’re testi...

zaproxy.org

ZAP – Getting Further with ZAP Scripting

The world’s most widely used web app scanner. Free and open source. ZAP is a community project actively maintained by a dedicated international team, and a GitHub Top 1000 project.

zaproxy.org

ZAP 2.17.0

ZAP 2.17.0 has just been released. The release includes core performance improvements and will significantly reduce the number of “duplicate” alerts reported.

zaproxy.org

React2Shell Detection with ZAP

React2Shell is the latest big “named” vulnerability - heres how you can detect it with ZAP.

zaproxy.org

ZAP Updates - November 2025

2.17.0 is coming soon, along with Insights and fixes for some issues that caused ZAP to log 50 million errors in one day!

zaproxy.org

Enhancing ZAP with AI for Bug Bounty Hunting

Building an intelligent security testing system that leverages ZAP’s automation capabilities and machine learning to improve vulnerability detection

zaproxy.org

50 Million Errors in One Day?!

ZAP logged a LOT of errors yesterday - heres why, and what we have already done to address the underlying problems

zaproxy.org

Release w2025-11-24 · zaproxy/zaproxy

File Checksum (SHA-256) ZAP_WEEKLY_D-2025-11-24.zip 6a0bab4207bdd498c24fd0edc6eddfa0789cf80510a8290ba3481d573458ccf2

github.com