Big announcement! We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider. More details in the blog post: www.zaproxy.org/blog/2026-07... #zaproxy #appsec

ZAP Blog: June Updates www.zaproxy.org/blog/2026-07... More PTK integration, lots of Client Spider improvements, and much more.. #zaproxy #appsec

Blog Post: Even More OWASP PTK Integration with ZAP. SAST and IAST passive scanning out of the box with the Client Spider, and the active rule is now enabled by default. www.zaproxy.org/blog/2026-06... #zaproxy #owaspptk #appsec

An Insecure Java Deserialization vulnerability has been reported in a ZAP add-on via Neo by ProjectDiscovery. Update your ZAP add-ons now, and definitely update from older versions of ZAP. For more details see: www.zaproxy.org/blog/2026-06...

ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. Check out the dramatic improvement in the scores vs Google Firing Range! www.zaproxy.org/blog/2026-06... #zaproxy #owaspptk #appsec

In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on. www.zaproxy.org/blog/2026-06... #zaproxy #appsec

ZAP can now scan MCP Servers, in the Desktop, Automation Framework and in a new GitHub Action. Read all about it on the blog: www.zaproxy.org/blog/2026-05... #zaproxy #appsec #mcp

Blog: Automating OWASP PTK with ZAP (Phase 1) You can now automate OWASP pentestkit using ZAP www.zaproxy.org/blog/2026-05... #zaproxy #owasp-ptk #appsec

Blog: Vibe coding security fixes. www.zaproxy.org/blog/2026-04... Learn how ZAP can help you make your vibe coded projects more secure. #zaproxy #vibecoding #appsec

Guest Blog: www.zaproxy.org/blog/2026-04... Learn how to integrate ZAP with KRO in a Kubernetes cluster to scan the security of each new deployment. ℅ Trevor Mountney #zaproxy #kubernetes #appsec

Blog: ZAP Updates for March: www.zaproxy.org/blog/2026-04... ZAP was started 9.5 MILLION times .. and we announced significant collaborations with other open source projects #zaproxy #appsec

Introducing the ZAP MCP Server www.zaproxy.org/blog/2026-04... #zaproxy #mcp #ai #appsec

This is huge! www.zaproxy.org/blog/2026-04... OWASP PTK massively increases ZAP’s browser side testing capabilities .. and automation is up next! Many thanks to Denis Podgurskii for this great integration. #zaproxy #owasp #appsec

New ZAP Blog Post: www.zaproxy.org/blog/2026-03... This post describes an approach that uses static analysis findings to guide ZAP’s active scans toward the most relevant endpoints. The result is a faster scanning mode suited for CI/CD pipelines. Thanks to the Seqra Team! #zaproxy #appsec

New ZAP Blog Post: Introducing DeepViolet: The Engine Behind ZAP’s New TLS Analysis www.zaproxy.org/blog/2026-03... Thanks to Milton Smith #zaproxy #deepviolet #appsec

New blog post: ZAP Updates - February 2026 www.zaproxy.org/blog/2026-03... #zaproxy #appsec

Do you need even more control over the browsers that you can launch from ZAP? You’ve got it! www.zaproxy.org/blog/2026-02... #zaproxy #appsec

Combine the Encode/Decode/Hash add-on with CyberChef operations in ZAP Encode/Decode Scripts for flexible encoding, decoding, and hashing in your testing workflow. www.zaproxy.org/blog/2026-02... #zaproxy #appsec #cyberchef

New Blog Post: Detecting Circular Type References in GraphQL Schemas www.zaproxy.org/blog/2026-02... #zaproxy #appsec #graphql

New blog post: www.zaproxy.org/blog/2026-02... Highlights of 2025 and our initial plans for 2026, including more 3rd Party tool integrations, enhanced exploring and, yes, AI integration! #zaproxy #appsec #ai

www.zaproxy.org/blog/2026-01... #zaproxy #owasp #appsec

New “Getting Further with ZAP Scripting” pages: www.zaproxy.org/docs/getting... Looking for something more? Let @psiinon.bsky.social know!

ZAP 2.17.0 is now available! It includes performance improvements, a significant reduction in “duplicate” alerts reported, and new Insights which give you key information about scans. www.zaproxy.org/blog/2025-12... #zaproxy #appsec

New blog post: #React2Shell Detection with ZAP www.zaproxy.org/blog/2025-12... #zaproxy #appsec

The latest version of the retirejs add-on includes a test for CVE-2025-66478 which is marked as "critical" so update now to detect this vulnerability.

ZAP Updates for November 2025: www.zaproxy.org/blog/2025-12... 2.17.0 is coming soon, along with Insights and fixes for some issues that caused ZAP to log 50 million errors in one day! #zaproxy #appsec

New ZAP blog post - read how Telmon Maluleka is enhancing ZAP with AI for Bug Bounty Hunting www.zaproxy.org/blog/2025-11...

ZAP logged 50 MILLION errors yesterday 😮 Read the blog for more details! www.zaproxy.org/blog/2025-11... #zaproxy #appsec

Today’s weekly is the 2.17 Release Candidate! github.com/zaproxy/zapr... Feedback appreciated

The ZAP services may well be unavailable due to the ongoing Cloudflare problems. See www.cloudflarestatus.com for more information.

ZAP Updates for October: www.zaproxy.org/blog/2025-11... #zaproxy #appsec

We have just published a new ZAP weekly release, to fix a bug which could cause invalid JSON reports to be generated. If you are using the most recent weekly we recommend you update ASAP.

Sorry, we messed up! A new scan rule triggered the ZAP Check for Updates call even if you used the "silent" mode. For more details see www.zaproxy.org/blog/2025-10...

ZAP Blog: How to solve the Caido Labs using ZAP www.zaproxy.org/blog/2025-10... c/o 5ubterranean_

ZAP updates for September: www.zaproxy.org/blog/2025-10... #zaproxy #appsec

New blog post: Alert De-Duplification www.zaproxy.org/blog/2025-09... #zaproxy #appsec

The ZAP team has forked and will maintain WAVSEP going forwards. This blog post explains why. www.zaproxy.org/blog/2025-09... #zaproxy #appsec #wavsep

You can now configure ZAP Scan Policies using Alert Tags: www.zaproxy.org/blog/2025-09... #zaproxy #appsec

ZAP Updates - August 2025: www.zaproxy.org/blog/2025-09... Microsoft Online Login Support, forking wavsep and much, much more! #zaproxy #appsec

All of the translated ZAP help files on the Marketplace have been updated. Thanks to the Crowdin translators for their hard work! crowdin.com/project/zap-...

We have a new #evangelists channel on the ZAP Slack: www.zaproxy.org/slack/ For an invite go to www.zaproxy.org/slack/invite Join up and help spread the word about #zaproxy !

All of the ZAP Docker images in the Software Security Project Docker Hub org have now been deleted. If you were pulling from this org then please switch to the zaproxy org or use GHCR as per www.zaproxy.org/download/#do... #zaproxy #appsec

ZAP Updates - July 2025 Authentication improvements, Edge support, timing rule changes, Docker news, and a new scan rule. www.zaproxy.org/blog/2025-08... #zaproxy #appsec

Yesterday there were more than 25K ZAP scans run using old versions of ZAP. These are no longer being maintained. Update your ZAP installs now! #zaproxy #appsec

We will be deleting all of the ZAP Docker images from the Software Security Project Docker Hub within the next 2 weeks. If you are still pulling images from there then please switch to one of the maintained options: www.zaproxy.org/download/#do...

There is a new "ZAP is Out of Date" scan rule - learn more about it via this blog post www.zaproxy.org/blog/2025-07... #zaproxy #appsec

We've recently made some requested changes to the naming and implementation of scan rules which used Time Based attacks. @kingthorin.bsky.social has written about it here: www.zaproxy.org/blog/2025-07... #zaproxy #appsec

None of the major browsers are currently flagging the latest ZAP downloads as suspicious🎉 Thank you to whoever sorted that out!

ZAP now has full support for Microsoft Edge 😀 www.zaproxy.org/blog/2025-07... #zaproxy #appsec

As promised, here is the first set of documentation for all of the authentication improvements the team has been working on www.zaproxy.org/blog/2025-07... #zaproxy #appsec