OWASP ModSecurity Core Rule Set has released version 4.29.0, enhancing detection for shell command injection bypasses and expanding signatures for PHP web shells. This update addresses backslash-prefixed commands that can bypass alias resolution and improves false positive rates in SQL detection and Node.js dependency parsing. The release includes contributions from multiple developers, with a focus on tightening detection rules while reducing false alerts. Users are advised to test the updated rules against their specific traffic before deploying them into production

OWASP ModSecurity CRS 4.29.0 Released: Closes Shell Evasion Bypasses and Expands Web Shell Signatures

OWASP ModSecurity Core Rule Set just shipped version 4.29.0, tightening detection for backslash-prefixed shell command injection bypasses and expanding signatures for known PHP web shells. New rules flag quote-based obfuscation and stat utility invocations at Paranoia Level 2, while extensive updates to rule 942190 and rule 930120 finally fix lingering false positives in SQL detection and Node.js dependency parsing. Maintainer Felipe Zipitría merged 15 pull requests across 87 files, with peer-reviewed verification ensuring the new backslash-evasion catch catches payloads that previously slipped past alias-resolving checks. The verified release tag is now available on GitHub, though you should test the updated rules against your specific traffic before pushing to production.

OWASP ModSecurity CRS 4.29.0 Released: Closes Shell Evasion Bypasses and Expands Web Shell Signatures @ Linux Compatible