ZAP Updates - May 2026 Last Posted Tuesday June 2, 2026 In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on.