📢 Open WAF Day 2026 — Vienna, June 24th! 🇦🇹
A free, full-day event on WAFs, @coreruleset, and open-source security. CFP is open!
🎟️ Register: forms.gle/UckehAUPdR8xZV…
🎤 Submit a talk: forms.gle/PoBKhza7YcRLFd…
See you there! 🚀
#OWASP #WAF #AppSec #CRS

CRS will have its first community call on March 17, from 20:30 to 21:30 CET (19:30 UTC / 2:30 p.m. ET) and will be moderated by former CRS co-leader Christian Folini. Register here: coreruleset.org/register/commu…

A somewhat diminished OWASP⁩ CRS core team at the annual developers retreat / the ⁦@owasp⁩ project summit 2024 in Woburn Forest (group photo without squirrels and deer).

Meet the CRS team: Whether it's work or hobbies, Max – the Kiwi-German software developer from the Swiss Alps – wants to enjoy what he does. For him, the most important thing about the CRS project is the people. Read his portrait: coreruleset.org/20240903/meet-…

We are excited to announce United Security Providers as Gold Sponsor of @CoreRuleSet. USP has been using CRS for a long time as an important component of its web access management solution. Support from sponsors is of great importance for the CRS project. coreruleset.org/20240903/unite…

The CRS project has released version 4.6.0 for CRS 4 and version 3.3.6 for CRS 3.
The new releases tackle two multipart file upload bypass methods. All users are requested to update to the new releases.
Read more and get the new releases: coreruleset.org/20240829/crs-v…

Meet the CRS team: Programming and entrepreneurship run in Jozef Sudolsky's family. When not working for his company or the @CoreRuleSet, he's in the gym or his garden. His office is his daughter's playroom. Read the portrait: coreruleset.org/20240507/meet-… #waf #crs #itsecurity #owasp

Today, the @CoreRuleSet has released #CRS v4.1.0. The new release is the first according to the new monthly release schedule and brings a couple of new features and fixes.
Read the changelog here: github.com/coreruleset/co…
#waf #CyberSecurity #owasp

With the transfer of @ModSecurity from @Trustwave to @owasp, the uncertainty over ModSecurity's future has finally come to an end. What does this mean for the @CoreRuleSet and @corazaio? Read more in our blog: lnkd.in/eJBtwRQh

#crs #firewall #owasp #cybersecurity #waf

On November 5–12, the @CoreRuleSet core team met in #Budapest for the annual retreat. Much work was done in that week, but, of course, there was a lot of fun activities, too. Read our blog:
Day 1: coreruleset.org/20231105/unive…
Days 2–7: coreruleset.org/20231128/discu…
#ModSecurity #waf #crs

Meet the CRS team: As a South American, Felipe Zipitra has a special status in the @CoreRuleSet core team. The Uruguayan played basketball which taught him all about the value of teamwork. Read Felipe‘s portrait on the CRS blog: coreruleset.org/20231130/meet-…
#waf #crs #itsecurity

It’s finally here: the @CoreRuleSet Retreat 2023 in #Budapest, #Hungary! For the next week, we have a lot to discuss and to work (and to drink). Egészségére!

This year, the @CoreRuleSet for the second time took part in the Google Summer of Code initiative. Dexter Chang had applied to the CRS project with a proposal for a performance framework: coreruleset.org/20230921/crs-p…
#GSoC #waf #CyberSecurity

CRS users are the best!

From November 5–12, the @CoreRuleSet core team will meet in Budapest for the Developer Retreat 2023. We will code together and discuss the roadmap and the future of the CRS. CRS contributors who like to participate in the retreat please contact @ChrFolini. #crs #coreruleset #waf

The #OWASP #ModSecurity @CoreRuleSet team is pleased to announce the release of #CRS3 version 3.3.5. This is a security release that mitigates CVE-2023-38199: a potential impedance mismatch vulnerability from requests with multiple Content-Type headers. coreruleset.org/20230724/crs-v…

The chat archive of the @CoreRuleSet project online meeting from Monday, July 3, is now available for reading on #GitHub. July 17 will follow soon.
You can find all chat archives since November 2018 here: github.com/coreruleset/pr… #crs #coreruleset #waf

@CoreRuleSet has opened a #YouTube channel. Contact us if you think you have fitting content. And don’t forget to give a thumbs up to the videos and subscribe to the channel if you don’t want to miss any new content. youtube.com/@owaspmodsecur… #crs #modsecurity #owasp #appsec #waf

#BugBounty programs are not for sissies! The @CoreRuleSet had to learn this the hard way, as you can read in @ChrFolini's new blog post on our website: coreruleset.org/20230509/what-…
#modsecurity #crs #waf #owasp #appsec

Meet the CRS community on February 14, at the community summit in Dublin! Registration is now open, attendance is free. Expect a variety of talks about #CRS, #ModSecurity and #Coraza. And join us for dinner after the “official” program.
More information: coreruleset.org/20230119/regis…

Meet the @CoreRuleSet team: @bufrasch. She was on her way to Earth orbit when she reconsidered. Now she works tirelessly through lists of bypasses. And she doesn't like to talk about herself. Read the new CRS developer portrait!
coreruleset.org/20230117/meet-… #modsecurity #owasp

If you want to test them out, try our sandbox at sandbox.coreruleset.org.
Here's a sample: curl --header "x-crs-paranoia-level: 1" --header "x-format-output: txt-matched-rules" --header "x-crs-version: nightly" -d@data 'sandbox.coreruleset.org'

The #OWASP #ModSecurity @CoreRuleSet project will hold the first post-pandemic Community Summit at the Dublin Convention Center in Ireland on Tuesday, February 14, 2023.
More information and the program will be available in due time.
coreruleset.org/20221209/save-…

The ModSecurity @CoreRuleSet project is proud to announce a new Silver sponsor: Switzerland's bug bounty pioneer @bugbounty_ch. Bug Bounty Switzerland has decided to support CRS as one of the most important pieces of software they see at their customers.
coreruleset.org/20221208/bug-b…

From October 29 to November 5, the @CoreRuleSet team met for the annual developer retreat in Italy. They had a lot of work, e.g. preparing the rule set for the v4 release and defining a project strategy for the future. Read here: coreruleset.org/20221201/the-c… #modsecurity #owasp #CRS4

Meet the @CoreRuleSet team: @IamAirWeen. He operates the HF radio bands with Morse code at high speed and likes garden work. Many CRS tools are based on his parser. Read the new CRS developer portrait on the blog! More to follow.
coreruleset.org/20221122/meet-… #modsecurity #owasp

Our Dev-on-Duty tries to respond within 24 hours to #OWASP #ModSecurity @CoreRuleSet questions coming in through various channels, including security.stackexchange. On-duty this week: our @bufrasch.

What a phenomenal place for a CRS roadmap discussion! @CoreRuleSet at the retreat in villacagnola.com. (More about the contents and results of that discussion soon on the CRS Blog.) #coreruleset #italy

“Dev on duty, how can I help you?” The CRS Dev on Duty office has relocated to beautiful Italy - sadly only during the developer retreat in villacagnola.com …

Meet the @CoreRuleSet team: @AndreaTheMiddle. He likes to play board games and the guitar, and he loves to fix bypasses to CRS rules. What does it take to join the team? Read the first CRS developer portrait on the blog. More to follow.
coreruleset.org/20221018/meet-… #modsecurity #owasp

The #OWASP #ModSecurity team is relieved to announce the #CRS3 releases 3.3.3 and 3.2.2 alongside CVE-2022-39955, CVE-2022-39956, CVE-2022-39957 and CVE-2022-39959.

These are security releases, so please update your servers.

coreruleset.org/20220919/crs-v…

CRS news: The #OWASP @CoreRuleSet team has named Felipe Zipitría a co-lead of the project. This and some plans for 2022 in this blog post:
coreruleset.org/20220308/crs-n…
#CRS3 #CRS4

Our @ChrFolini has written an introduction to the new @CoreRuleSet Fake Bot Plugin.
coreruleset.org/20220209/intro…

BREAKING: #OWASP #ModSecurity @CoreRuleSet talks #ModSecurity and presents #CorazaWAF by @jptosso.

coreruleset.org/20211222/talki…

Not sure I follow you with regards to #bypass.

This is SCREAMING sql injection.

OK, here is the #CRS #log4j / #log4shell #WAF Bypass contest.

We don't know of any jndi/ctx log4j payload that we don't detect. Show us your evasions and see if you can make it into our hall of fame!

#OWASP #ModSecurity #CRS3 @CoreRuleSet CVE-2021-44228
coreruleset.org/20211216/publi…

New update to generic rule 1005 in our blog post on mitigation of the #log4j / #log4shell / CVE-2021-44228.

Potentially dangerous backtracking fixed with range limiter after risk of whitespace has been ruled out.

coreruleset.org/20211213/crs-a…

You can now test an attack payload against the #OWASP @CoreRuleSet without the need to install #CRS3 or #ModSecurity first.
Use our API with curl and hack away at the CRS Sandbox.

coreruleset.org/20211209/intro…

There is a lot of documentation work going on here at the @CoreRuleSet dev retreat. First polished outcome a blog post that explains to work with #CRS3 Paranoia Levels in a production setup.
coreruleset.org/20211028/worki…

While working heavily on things like a @CoreRuleSet demo-site on stereoids, we are also doing fun things: Which OSINT mastermind will guess what we did yesterday?
#CRS3

We're complete: Everybody arrived at the @CoreRuleSet developer retreat in Switzerland. Mountains all around a very beautiful scenery to hack #CRS3.

The @CoreRuleSet project is looking forward to @owasp's 20th birthday and the day-long online party with dozens of great talks from all different corners of the OWASP planet.
Join us on September 24 via 20thanniversary.owasp.org

We are proud to announce our first Gold Sponsor: @nginx

That's great news because this allows us to do more for our developer community and also for our users, supporting them better than we did so far!

coreruleset.org/20210305/annou…

CC @owasp
#CRS3

The #OWASP Foundation Spotlight Series by @InfosecVandana covered @CoreRuleSet in its third edition:
youtube.com/watch?v=88ZMKp…
#CRS3

The @owasp #ModSecurity @CoreRuleSet team is proud to announce the general availability of the v.3.3.0 release.

See coreruleset.org/20200701/owasp…
for more infos on new features and bugfixes.

The @owasp #ModSecurity @CoreRuleSet project has moved its github.
We are now living at github.com/coreruleset/co…
Please spread the word.
Blogpost with details at coreruleset.org/20200513/crs-r…

The guys at @FraktalCyber have taken a closer look at various cloud #WAF offerings. Needless to say that @CoreRuleSet came out on top. By far.
medium.com/fraktal/cloud-…
#CRS3 #Azure #ModSecurity

ModSecurity 3.x suffers from a severe #DoS vulnerability (#CVE-2019-19886) that also ruins the underlying webserver, typically #NGINX.

CVSS is 7.5 (HIGH).

Please upgrade 3.x to #ModSecurity 3.0.4.

ModSec 2 is not affected.

coreruleset.org/20200118/cve-2…

Here we see the @CoreRuleSet throw up in disgust after an @OwnCloud iOS app uploaded an image with content type "application/x-www-form-urlencoded" (I kid you not!!!). This blew away every previous record anomaly score in the history of mankind. 🍾💯🍾💯🍾💯
#CRS3