Pinned Tweet
🛡️ Open WAF Day Vienna 2026 — full agenda is live!
📅 Wed June 24 · Austria Center, Vienna
🎤 5 talks: Coraza on Envoy, GitOps, Ingress NGINX migration, adaptive honeypots & more
💸 Free
Register 👇
coreruleset.org/20260603/ope…
3
140
Open WAF Day Vienna 2026 recap is up 🇦🇹 Talks on the new Coraza/Envoy connector, blazing-fast WAF log analysis, Coraza Center + GitOps, life after Ingress NGINX, and CRS-powered adaptive honeypots. Thanks to everyone who joined us!
📖 coreruleset.org/20260629/ope…
#OWASP #WAF #AppSec
1
3
439
Part 2 of the CRS 3→4 migration series: configuration. Don't reuse your old crs-setup.conf — variables were renamed, split, and added. Post includes a full checklist and an interactive migration tool.
coreruleset.org/20260406/mig…
#OWASP #CRS #WAF #AppSec
2
118
Migrating from OWASP CRS 3.3 to 4.25 LTS? Part 1 of a 7-part series is out — covering what changed, what breaks, and how to plan your upgrade. ~500 changes, new plugin architecture, RE2/Hyperscan compat, and more.
coreruleset.org/20260330/mig…
1
4
138
🔒 Security Advisory: OWASP CRS file upload extension checks could be bypassed using whitespace padding in filenames (e.g. shell. php). CVE-2026-33691, Moderate severity.
Upgrade to CRS v4.25.0 or v3.3.9.
Thanks @HackingRepo for the report!
github.com/coreruleset/corer…
4
4
333
OWASP CRS v4.25.0 LTS is out! First Long-Term Support for CRS 4 — stable foundation with security patches through Q3 2027. Formal backport policy, lessons from 3.3 applied, and crslang on the horizon.
coreruleset.org/20260321/ann…
1
7
15
3,220
📢 Open WAF Day 2026 — Vienna, June 24th! 🇦🇹
A free, full-day event on WAFs, @coreruleset, and open-source security. CFP is open!
🎟️ Register: forms.gle/UckehAUPdR8xZVkd8
🎤 Submit a talk: forms.gle/PoBKhza7YcRLFdFU6
See you there! 🚀
#OWASP #WAF #AppSec #CRS
2
76
🔥 OWASP CRS is evolving! Introducing #CRSLang — a new YAML-based rule language replacing Seclang. Cleaner syntax, multi-engine support, bidirectional translation, and a lower barrier for new contributors.
Check it out 👉 coreruleset.org/20260122/int…
#WAF #AppSec #OWASP #ModSecurity
4
14
2,652
📦 CRS v4.23.0 released!
New CVE detection, SSRF improvements, PHP session upload prevention & more.
Thanks to our amazing contributors: @touchweb_vincent, @azurit, @RedXanadu, @EsadCetiner, @Xhoenix & welcome @disisto! 🎉
Upgrade now 👇
github.com/coreruleset/corer…
5
20
2,542
🎉 Introducing seclang_parser - a unified ANTLR-based parser for SecLang! One grammar, multiple languages (Go & Python), endless possibilities for WAF tooling: linters, IDE integration, config management & more.
🔗 coreruleset.org/20260122/int…
1
5
170
CRS3→CRS4 migration made easy! 🚀
🧩 New GPL plugin lets you:
• Run CRS4 in monitor mode over CRS3
• Weed out false positives
• Gradually enable blocking or sampling
github.com/netnea/netnea-crs…
#OWASP #CRS #Security
1
3
188
🚀 OWASP CRS v4.20.0 is out!
✨ New: Enhanced file restrictions, PrestaShop/Magento configs, Expect header blocking
🛠️ Multiple fixes reducing JSON false positives + better detection
👉 github.com/coreruleset/corer…
#OWASP #CRS #WebSecurity #AppSec
2
2
179
CRS will have its second community call on September 22, from 20:30 to 21:30 CEST (18:30 UTC / 2:30 p.m. ET) and will be moderated by former CRS co-leader Christian Folini. Check more details and register here: luma.com/8yc1p543
4
7
2,429
A critical vulnerability in Microsoft Sharepoint was recently discovered, allowing remote code execution -- in many cases, leading to persistence for the attackers, exfiltration of data, and more. Users of CRS were already covered from day zero using PL2.
3
6
211
CRS will have its first community call on March 17, from 20:30 to 21:30 CET (19:30 UTC / 2:30 p.m. ET) and will be moderated by former CRS co-leader Christian Folini. Register here: coreruleset.org/register/com…
3
7
402
A somewhat diminished OWASP CRS core team at the annual developers retreat / the @owasp project summit 2024 in Woburn Forest (group photo without squirrels and deer).
2
8
324
Meet the CRS team: Whether it's work or hobbies, Max – the Kiwi-German software developer from the Swiss Alps – wants to enjoy what he does. For him, the most important thing about the CRS project is the people. Read his portrait: coreruleset.org/20240903/mee…
3
246
We are excited to announce United Security Providers as Gold Sponsor of @CoreRuleSet. USP has been using CRS for a long time as an important component of its web access management solution. Support from sponsors is of great importance for the CRS project. coreruleset.org/20240903/uni…
1
1
5
202
See also the blog post on @uspag‘s website: united-security-providers.ch…
153
Core Rule Set retweeted
New versions of ModSecurity have been released, see the blog post:
modsecurity.org/20240903/new…
8
10
1,114