The chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, 2026-05-04, at 20:30 CET (CEST during summer in the Northern Hemisphere). That's the 1st Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).

Archived previous meetings and their decision are here.

What happened in the meantime since the chat last month

Outside development

Inside development

Rules

CRS Sandbox

• Sandbox was updated to fully run on ECS

Security

• ModSecurity has released updated versions

Plugins

Documentation and Public Relations

Project Administration and Sponsor relationships

Tools

• crs-toolchain updated with improved regex validation and handling of escape sequences for 8-bit PCRE

Testing incl. Seaweed and many future plans

• Nothing here.

Containers

• Versions updated with CRS 4.25.0 LTS shipped.

Project discussions and decisions

Rules development, key project numbers

PRs that have been merged since the last meeting

• chore: post-release v4.27.0-dev #4630
• chore: release v4.26.0 #4629
• fix(942290): add word boundary to MongoDB operator detection #4588
• fix(lfi-os-files): add .dockerenv, .DS_Store, META-INF/, WEB-INF/ #4601
• feat(933100): all HTTP headers should be checked #4603
• fix(920539): prefer a bypass on a named rule rather than n+1 bypass #4610
• fix: Update restricted files to include Perl subdirectories #4620
• feat(934200): detect Server-Side Template Injection (SSTI) attacks #4600
• fix(920100): drop HTTP/0.9 GET support from request line validation #4621
• docs: add AI policy #4611
• fix(942200): reduce false positives on payloads with comments #4608
• fix(930130): comment out false positive prone entries #4607
• fix(unix): exclude pg command from pl-1 #4613
• fix: update linter ignore directive in initialization config #4618
• chore: add crs-linter exceptions #4616
• fix: false positive with parameter name .history #4614
• fix(942410): use common exceptions instead of rule #4617
• chore(deps): update owasp/modsecurity-crs:nginx docker digest to d5075e2 in tests/docker-compose.yml #4605
• chore(deps): update owasp/modsecurity-crs:apache docker digest to 45ee5bf in tests/docker-compose.yml #4604
• fix(932370): remove url from Windows LOLBIN command list #4587

We merged 20 PRs since the last monthly project chat.

Open PRs

Open PRs marked DRAFT or work in progress or needs action

• feat: added detection for quote evasion #3813
• test: add containerized default go-ftw tests to docker compose file #4627
• feat: Expand web shells (v1) #4626
• fix(932130): detect ANSI-C quoting hex-encoded commands #4598
• fix(932330): require non-alphanumeric prefix for bash negation pattern #4595
• fix(932270): require boundary before tilde expansion patterns #4596
• fix(942390): move to regex-assembly #4011
• refactor: create 941170 .ra file #4493
• chore: improves quant output with run details #4318
• feat: add rule 920442 on PL3 to detect more file extensions #4324
• feat: updated unix shell builtins #4271
• fix(943110): remove generic session-id and session_id from PL1 #4590
• fix(932): remove w from Unix no-arguments command list #4592
• fix(932): require arguments for base64, lastlog, lastlogin #4593
• fix(942190,942230): detect SQLite == and GLOB, PostgreSQL ARRAY @> #4597
• fix(932): remove brace from Unix shell evasion prefix #4591
• fix(932): add backslash-prefix evasion to shell command detection #4599
• fix(942550): restrict first SQLite/PostgreSQL branch to single-quote and backtick #4589
• feat: add 921500 - Nonstandard urlencode characters in path #4302
• fix(942360): update sqli payloads #4238
• fix(security): resolve SQL injection protection bypass (942380 PL2) #3720
• feat(921300): Query delimiter confusion #4571
• fix(931130): Isolating 2-chars sequence with high risk of false positive on high entropy input #4304
• fix(921422): reduce false positive #4433
• feat(942500): stronger hardening to improve PL1 protection #4328
• fix(942360): avoid c-type comment evasion #4325
• feat: add rule 920550 on PL2 to detect more file extensions #4323

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp.org/slack/invite .

Everybody is welcome to join our community chat.