Open-source Web Application Firewall maintained by OWASP. Blocking threats since 2002. Free, community-driven, expert-led, and actively developed.
Earth
Joined April 2009
- Tweets1.6K
- Following18
- Followers4.6K
- Likes63
Please welcome the latest releases of ModSecurity.
github.com/owasp-modsecurity…
github.com/owasp-modsecurity…
And before you update, please read the relevant blog post:
modsecurity.org/20260928/sec…
Hi guys, we are pleased to present the revamped modsecurity.org website!
Awesome - please update your package:
xitter.cf/ModSecurity/status/207…
A new version of libmodsecurity3 has been released, please check the blog post and update your library:
modsecurity.org/20260629/abo…
A new version of libmodsecurity3 has been released, please check the blog post and update your library:
modsecurity.org/20260629/abo…
"How big is too big" - a new blog post has been published on modsecurity.org - enjoy reading!
modsecurity.org/20260222/how…
Probably there is a typo here (see the image): there is no such operator ">=". Perhaps you though "@gt".
A new version of mod_security2 has been released, please check the blog post:
modsecurity.org/20250805/imp…
A new version of mod_security2 has been released, please check the blog post:
modsecurity.org/20250701/dos…
We don't know how old is this article, but please update it. There is a much newer version than 2.9.7 (2.9.10 is the last release).
With CRS, ModSecurity catches this attack on PL1.
$ curl -X POST -d 'q=<a href="jav%0Dascript:alert(1)">' -H "x-format-output: txt-matched-rules" sandbox.coreruleset.org/
Output:
941390 PL1 Javascript method detected
949110 PL1 Inbound Anomaly ...
980170 PL1 Anomaly Sco...
"No Patch" - you misinform your users. The patch was applied earlier than the advisory was published. Please take a look at our GH page.
New version of mod_security2 have been released: github.com/owasp-modsecurity…
This versions includes a fix against a recently discovered (another) DoS vulnerability: modsecurity.org/20250602/dos…
Please upgrade your module!
Why is difficult? Feel free to ask on Github or on Slack: owasp.org/slack/invite, channel "project-modsecurity"
New version has been released:
Nginx connector: github.com/owasp-modsecurity…
blog post: modsecurity.org/20250521/mod…
Please note that the log format has been changed!
New version have been released:
mod_security2: github.com/owasp-modsecurity…
This versions includes a fix against a recently discovered DoS vulnerability: modsecurity.org/20250521/pos…
Please upgrade your module!
Happy to announce OWASP Open WAF Day: owasp2025globalappseceu.sche…
Feel free to register yourself!
#modsecurity #coreruleset #crs #coraza #waf
Please take a look at this issue and share your opinions (on GH):
github.com/owasp-modsecurity…
There are several ways.
- join to our Slack community: owasp.org/slack/invite, check "# project-modsecurity" channel
- send any pull request on GH
- you can reach us in e-mail: modsecurity at owasp dot org