Initial support for handling OAuth2.0 is now available.

Details on the ZAP Blog: www.zaproxy.org/blog/2026-10...

Lots of other add-ons have also been updated, so update ZAP now!
#appsec #zaproxy

ZAP Updates for September:
The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP’s nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.
www.zaproxy.org/blog/2026-10...
#zaproxy #appsec

The latest weekly release does not include the AJAX Spider and DOM XSS add-ons.
You can install them via the Marketplace as usual, but we recommend you using the Client Spider and OWASP PTK add-ons instead.
For more details see www.zaproxy.org/blog/2026-09...
#zaproxy #appsec

ZAP updates for August.
We’re removing 2 add-ons from the nightly and weekly releases, so if you use those then make sure you read it to understand the implications.
www.zaproxy.org/blog/2026-09...
#zaproxy #appsec