36 results for “Wiz Research”

Wiz Research links October 2026 breaches at AI developer platforms (Fireworks, OpenCode, Warp, Zeabur, Railway and others) to stolen environment-variable credentials for AI access. It details two enterprise AWS Bedrock keys abused after vendor breaches: about 800k and 1.7 million calls, over $100k in list-price usage. It profiles two LLM resale operations, "momo" and "Xingjiabi", that tested the keys.

wiz.iowriteupAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

Wiz Research reviews agentic attacks seen in its incident response work and in public reports (ARTEX, Hermes, JPCERT/CC, CrowdStrike, DIVD). It derives fingerprints of AI-agent activity from three intrusions: machine-paced iteration, natural-language reasoning in scripts, self-correcting script versions, checklist enumeration, noisy lateral spraying, probe-before-payload and self-labeled scratch files. It also covers effects on attribution, attack scale and defense.

wiz.ioarticlePublished and added 29 Oct 2026🛡️ Security

Wiz research on intrusions where AI agents do the hands-on attacker work. It reviews public cases (ARTEX against South Korean banks and the ConnectWise compromise, Hermes at Thailand's Ministry of Finance, JPCERT/CC, CrowdStrike, DIVD) and three Wiz-investigated attacks. It distills fingerprints: machine-paced iteration, embedded natural-language reasoning, self-correcting scripts, checklist enumeration, noisy lateral movement, probe-before-payload habits and self-named scratch files. It also covers attribution, scale and defense implications.

wiz.iowriteupPublished and added 29 Oct 2026🛡️ Security

Wiz Research follow-up on PHP2Shell (CVE-2026-109618, CVE-2026-109619) after the 21 October 2026 disclosure. Honeypot data shows two variants of an open source exploit kit, one stopped by post_max_size and the other by failed memory leaks and worker pinning, plus PHP2Shell-branded tools that rely on session poisoning and LFI. Daily exposed vulnerable machines fell about 67%.

wiz.ioarticlePublished and added 27 Oct 2026🛡️ Security

Gheist is a campaign tracked by Wiz Research since 15 September 2026 that uses stolen GitHub tokens to push a sync-check workflow on ci-sync-* branches in every reachable repository. The workflow prints base32-encoded secrets into logs, which the tool downloads through the GitHub API and then deletes. Over 13,500 branches from 850+ accounts were recovered. The post covers the two tool variants, a buggy self-hosted runner payload, GitHub's approval hold (which does not cover private repositories), overlaps with other campaigns, hunting queries, IOCs and hardening steps.

wiz.iowriteupPublished and added 25 Oct 2026🛡️ Security

Wiz Research reports an actor overlapping with Storm-0940 that used ARTEX, an open-source autonomous AI penetration-testing agent, against IT and software vendors in October 2026. It documents source-map and Swagger recon, OAuth callback and unsigned JWT probing, Cognito account-recovery abuse, tenant-isolation tests and Okta/Entra password spraying. The post lists log signals that mark the activity as agentic, such as one-second spray cadence and automatic IP and user-agent rotation.

wiz.ioarticlePublished and added 22 Oct 2026🛡️ Security

Simon Willison's link post on the 21 October 2026 PHP security release, which fixes two remote code execution flaws across the PHP 8.x line. The CVE IDs leaked on 20 October with a wrong CVSS of 10.0 (actual 9.2), and Calif accidentally published a proof-of-concept video. It also gives Wiz Research's timeline, with unauthenticated RCE confirmed against Drupal and WordPress in August 2026.

simonwillison.netarticlePublished and added 21 Oct 2026🛡️ Security

PHP2Shell is the name for two critical PHP core memory-safety flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. Fixes ship in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Wiz researchers demonstrated RCE against WordPress, Drupal and Joomla, and Apache with mod_php is the highest risk. The post covers inventory, container rebuilds, Cloudflare WAF rules and temporary exposure reduction.

endorlabs.comadvisoryPublished and added 21 Oct 2026🛡️ Security

PHP2Shell is Wiz Research's disclosure of memory-safety bugs in core PHP, grouped under two CVEs (up to CVSS 9.2) and fixed in patched releases on 21 October 2026. The post details four bugs, all triggered by out-of-memory fatal errors that leave stale state: an upload-progress unserializer use-after-free, a session-ID memory disclosure, a fatal-error backtrace use-after-free and an OPcache type confusion. It describes unauthenticated RCE on WordPress, Drupal and Joomla, plus detection signals and a disclosure timeline.

wiz.iowriteupPublished and added 21 Oct 2026🛡️ Security

Wiz Research examined the source repositories and CI/CD pipelines behind 1,500 popular Helm charts on Artifact Hub (mapping to 814 unique GitHub repos) and found 61 repos (7.5%) with confirmed supply-chain risk, including 20 charts with CI/CD workflow weaknesses and 25 depending on unmaintained/archived upstream projects. Two disclosed findings illustrate the risk classes: KubeView's go.mod referenced a Go module under a GitHub username that didn't exist, making it hijackable by anyone who registered the name, and Meilisearch's Helm chart repo had a GitHub Actions workflow triggered by PR comments that injected the commenter's branch name into a shell command while skipping author-association checks, letting any GitHub user run commands with a bot token that had push access. The post then pivots to promoting WizOS Helm Charts, Wiz's hardened/signed/CVE-scanned chart catalog built to close these gaps.

wiz.ioarticlePublished and added 30 Sep 2026🛡️ Security

Wiz Research analyzed infostealer-harvested secrets (via its NordStellar integration) to map exactly which credentials malware families like Lumma, RedLine, and Vidar target across AWS, Azure, GCP, GitHub, GitLab, and AI platforms, and how those secrets translate into cloud account takeover. It gives concrete file paths and artifacts attackers hunt for (~/.aws/sso/cache OIDC tokens, Azure accessTokens.json, GCP credentials.db/access_tokens.db, GitHub gh hosts.yml and SSH keys, GitLab Runner config.toml, OpenAI/ChatGPT session cookies, and Claude Code's ~/.claude/.credentials.json OAuth tokens), plus stats: three malware families cause 85.7% of incidents, AWS/GCP account for 46%/13% of stolen secrets, GitHub ~10%, AI platforms ~5%. It also covers CI/CD-targeting infostealers (Miasma, TeamPCP) and session-cookie hijacking as an MFA bypass technique.

wiz.iowriteupAdded 27 Sep 2026, published 25 Sep 2026🛡️ Security

Wiz researchers reverse-engineered AWS's new sign-up experience, which silently creates a three-account AWS Organization (management, identity, and a restricted sandbox member account) with Builder ID login instead of root credentials. They found the sandbox blocks security services like GuardDuty, SecurityHub, Detective, Inspector, Macie and Access Analyzer via an allowlist SCP (FreeTierSCP), while still permitting risky practices such as IAM user access keys, public S3 buckets, and IMDSv1 EC2 instances; a data-perimeter RCP also blocks cross-account sts:AssumeRole until the account is upgraded, potentially pushing vendors back toward IAM user keys. The new IAM Role Manager feature further undermines least privilege by auto-attaching PowerUserAccess to console-created roles.

wiz.iowriteupPublished and added 17 Sep 2026🛡️ Security

Shai-Hulud-2.0-Detector is a GitHub Action and CLI tool that scans package.json/lockfiles for packages compromised in the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain worms. It uses semver-precise matching against a database of 1,241+ known-compromised package versions (auto-updated daily from Datadog and Wiz Research feeds) to flag malicious preinstall/postinstall droppers (setup_bun.js, Math_Symbol.js), rogue GitHub self-hosted runners named SHA1HULUD, and ChainDrop's new IDE-persistence hooks in .claude/settings.json and .vscode/tasks.json. It ships SARIF output for GitHub Security tab integration, an allowlist system, and a detailed incident-response guide covering credential rotation and forensic checks.

github.comrepoAdded 16 Sep 2026🛡️ Security

Wiz Research documents active in-the-wild exploitation of three JFrog Artifactory vulnerabilities: CVE-2026-42018 (exposes an internal anonymous-user JWT via POST /access/api/v1/aws/token/), CVE-2026-42016 (token scope validation flaw allowing that JWT to be escalated to admin via POST /access/api/v1/tokens), and CVE-2026-82329 (unauthenticated admin access via POST /access/api/v1/registry/join, added to CISA KEV). Attackers chained the first two to create persistent admin accounts, deploy malicious Groovy plugins for RCE, and drop Rust-based C2 backdoors, while CVE-2026-82329 was exploited independently for configuration exfiltration, cluster join-key theft, and credential/SSH-key persistence. The post includes exact request sequences, detection signatures, affected/fixed version ranges, and remediation guidance.

wiz.ioadvisoryPublished and added 10 Sep 2026🛡️ Security

Wiz researchers chain three LiteLLM flaws into a full pre-auth-to-cloud-compromise path: an MCP endpoint authentication bypass (CVE-2026-59822) that grants a session with any garbage Bearer token, a custom-code-guardrail sandbox bypass leading to root RCE (CVE-2026-59821) via exec() on unsanitized admin-submitted Python, and a config-endpoint authorization gap (CVE-2026-35029). They also show pass-through endpoints can be pointed at the AWS IMDS to steal IAM credentials, bypassing IMDSv2 via header-prefix forwarding. A scan of ~3,074 internet-facing instances found 9.6% accepting the default sk-1234 master key or no auth at all, and CVE-2026-59822 is now in CISA's KEV catalog with observed in-the-wild exploitation.

wiz.iowriteupPublished and added 9 Sep 2026🛡️ Security

Wiz Research's blog summary of its "State of Cloud Security Risk 2026" report finds that most high-severity cloud security alerts are not real attacker opportunities once environmental context (external reachability, toxic permission combinations, sensitive data access) is applied, eliminating over half of flagged findings. Key data points include the average vulnerability-to-exploitation window shrinking to 21.5 days (per Wiz's ZeroDayClock tracking), 30% of cloud environments containing an externally exposed machine tied to high-impact lateral movement paths, and software RCE accounting for only 9% of exploitable findings versus access/credential/secrets pathways.

wiz.ioarticleAdded 3 Sep 2026, published 26 Aug 2026🛡️ Security

Episode 18 of the OpenSourceMalware Show discusses the compromise of Rust maintainer 'dhrundy' that pushed malicious versions of arrayref (245M+ downloads), internment, and append-only-vec with a typosquatted build dependency executing a remote binary at compile time, which Wiz Research ties to DPRK infrastructure shared with the Mastra and Axios npm compromises. It also covers StubMaker, a campaign that started as RubyGems typosquats of bundler/i18n/rake/activesupport and shares byte-identical payloads (a 22MB Rust loader with an embedded Go infostealer, including a Chrome App-Bound Encryption bypass) with a 40-package npm typosquatting cluster targeting axios, chalk, commander, lodash, react and typescript, with signs it also hit PowerShell. The hosts also note a rising trend of attackers bundling compiled C++/Rust/Go binaries in npm/RubyGems packages (a red flag for analysts) and a PolinRider reinfection wave now using NullReceiver instead of EtherHiding for stage-two C2 hiding.

opensourcemalware.comtalkAdded 3 Sep 2026, published 21 Aug 2026🛡️ Security

Wiz researchers found that malicious versions of the Rust crates arrayref, internment, and append-only-vec were published to crates.io, each pulling in a typosquatted build-dependency (proc-macro1, mimicking proc-macro2) whose build.rs executes a remote payload at compile time. The payload beacons to a C2 endpoint (/49890878) shared with the Mastra campaign, disables TLS validation, enumerates Chrome/Brave/Edge saved logins via their SQLite stores, persists via Registry Run keys/LaunchAgents/systemd, and falls back to a DGA — with C2 infrastructure and SSL-issuer overlap tying it to DPRK/Sapphire Sleet activity previously seen in the Mastra and axios supply chain attacks. arrayref is used in roughly 75% of Rust environments, making this a high-impact build-time compromise.

wiz.iowriteupAdded 3 Sep 2026, published 20 Aug 2026🛡️ Security

Wiz research blog on how developers' personal public GitHub repositories create a secrets-exposure blind spot outside org security boundaries, citing that 65% of the Forbes AI 50 had verified secret leaks and 56% of company-impacting secrets lived in personal repos, often granting infrastructure-level access (cloud credentials, CI/CD tokens, AI service keys). It describes Wiz Code's approach: inventorying developer identities to discover the personal repos they own, mapping leaked secrets to attack paths on the Wiz Security Graph, and using an AI-driven "Red Agent" to validate exploitability before triggering rotation/remediation workflows.

wiz.ioarticleAdded 3 Sep 2026, published 13 Aug 2026🛡️ Security

Wiz Research reverse-engineers CVE-2026-72898 (GHSA-vwf4-m7j8-wcjf), a zero-day SQL injection in Metabase's /api/session/reset_password endpoint exploited in the wild against Metabase Cloud since August 2026. The bug chains Clojure's merge (which lets an attacker-supplied user-id survive an auth-result merge), JSON keywordization, and HoneySQL's :raw keyword to smuggle unparameterized SQL into a t2/select-one query, yielding blind SQL injection. The post walks through decompiling patched vs. vulnerable JARs to reconstruct the flaw, notes ~2,500 internet-exposed Metabase instances per Shodan, and gives a curl-based exploitability check plus remediation guidance.

wiz.iowriteupAdded 3 Sep 2026, published 10 Aug 2026🛡️ Security

Wiz Research documents an ongoing supply chain attack in which a compromised GitHub maintainer account was used to publish malicious versions of keyv, cacheable, and 400+ dependent npm packages. The payload is a variant of the open-sourced 'Mini' Shai-Hulud malware (linked to the TeamPCP and antv campaigns) that steals cloud, CI/CD, AI-agent, and cryptocurrency credentials, persists via Claude Code hooks and VS Code tasks.json, exfiltrates data to attacker-controlled GitHub repos, and retrieves its C2 domain dynamically via an Ethereum smart contract (StringListStore) eth_call rather than hardcoding it.

wiz.iowriteupAdded 3 Sep 2026, published 4 Aug 2026🛡️ Security

Wiz Research examines S3-compatible object storage offerings from Nebius, Vultr, Lambda Labs, Cloudflare R2, DigitalOcean, and Crusoe, showing how each deviates from AWS S3 security defaults. Findings include providers that expose access/secret keys via list APIs (Vultr), default ACLs that would be public but aren't enforced (Lambda Labs), lack of least-privilege key scoping (Vultr, Crusoe, Lambda Labs), weak or undocumented encryption-at-rest/TLS enforcement, unstructured access-key formats that evade GitHub/secret-scanner detection, and cross-tenant bucket namesquatting risk due to shared global namespaces.

wiz.iowriteupAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Wiz Research found CosmosEscape, a critical Azure Cosmos DB vulnerability exploited via the Gremlin API's .NET-based query engine, whose sandbox failed to restrict .NET reflection, enabling arbitrary code execution on the DB Gateway service. This allowed retrieval of the "Cosmos Master Key," a platform-wide signing key that could fetch any Cosmos DB account's primary key and enumerate accounts via a shared Config Store, enabling attackers to compromise any customer or internal Microsoft database (including those backing Entra ID, Teams, and Copilot) from public endpoints. Microsoft fully remediated the issue and eliminated the master key architecture.

wiz.iowriteupAdded 3 Sep 2026, published 30 Jul 2026🛡️ Security

Wiz Research scanned MCP servers across cloud environments and found roughly 1 in 6 environments expose at least one server to the Internet, most unauthenticated and still running the pre-auth 2024-11-05 protocol version. They demonstrate anonymous tool-catalog enumeration, real data returned from production databases/CRM/IAM backends, write/delete-capable tools, and confirmed SSRF against cloud instance metadata endpoints yielding temporary credentials, plus agents that can be talked into unsafe actions by reframing requests as "routine maintenance."

wiz.iowriteupAdded 3 Sep 2026, published 28 Jul 2026🛡️ Security

Wiz Research details Atlas, an autonomous multi-agent AI system for vulnerability discovery that ranks #1 on the CyberGym benchmark (90.9% success) and found 200+ previously unknown bugs in heavily audited projects like grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd. The post explains Atlas's four-stage pipeline (attack-surface mapping via code property graphs, parallel hypothesis hunting, adversarial validation between competing agents, and dynamic exploit triggering) and notes an early version of the system contributed to discovering a critical GitHub RCE (CVE-2026-3854) that paid GitHub's largest-ever bug bounty. It also outlines lessons from evaluation-driven development and plans to integrate Atlas into Wiz Code alongside Google CodeMender.

wiz.ioarticleAdded 3 Sep 2026, published 27 Jul 2026🛡️ Security

Wiz Research details how its Agentless Workload Detection uncovered active exploitation across a range of cloud/network appliances and services: FortiGate zero-day account creation (CVE-2026-24858), FortiBleed credential stuffing against ~75,000 devices, PAN-OS admin-account compromise (CVE-2026-0257) and CaptivePortal exploitation (CVE-2026-0300), a critical pre-auth BeyondTrust RCE (CVE-2026-1731), the memory-disclosure bug MongoBleed (CVE-2025-14847), Redis replication-abuse for RCE, a Zabbix instance compromised via default credentials, a Linux page-cache LPE called CopyFail, malicious npm package installs (@asyncapi/specs), and WordPress wp2shell webshells (CVE-2026-63030, CVE-2026-60137). It illustrates concrete detection logic (e.g. Redis replication target rules, unusual-executable HTTP access detections) built from agent-free log collection on virtual appliances that traditionally lacked EDR coverage.

wiz.ioarticleAdded 3 Sep 2026, published 21 Jul 2026🛡️ Security

Wiz Research documents active in-the-wild exploitation of "wp2shell," a pre-auth RCE chain in WordPress Core (CVE-2026-63030 and CVE-2026-60137) affecting every WordPress version since December 2025, discovered by Searchlight Cyber using GPT-5.6 Sol. Attackers abuse the WordPress REST API batch endpoint (/wp-json/batch/v1) to achieve unauthenticated RCE, then deploy malicious plugins/webshells (including a disguised "CMSmap" plugin and a custom REST endpoint backdoor), enumerate users, and attempt LFI against wp-config for credential theft. The post details post-exploitation TTPs, detection signatures (HTTP 207 responses, wp2shell/rezwp2shell user agents), IOCs, and WAF/plugin-based mitigations.

wiz.iowriteupAdded 3 Sep 2026, published 20 Jul 2026🛡️ Security

Wiz Research details how an attacker used 37 decoy pull requests to mask exploitation of a pull_request_target "pwn request" misconfiguration in the asyncapi/generator GitHub Actions workflow, stealing a privileged PAT belonging to the asyncapi-bot service account. The attacker then published four malicious npm packages (five versions) under the @asyncapi namespace with over 3 million weekly downloads, delivering a self-identified "M-RED-TEAM v6.4" multi-stage payload that fetches an 8.25MB encrypted bundle from IPFS and installs a 92,000-line trojan framework with systemd persistence and HTTP/Nostr/Ethereum/libp2p C2 channels, targeting browser credentials, SSH keys, npm/GitHub tokens, AWS credentials, and crypto wallets. The piece also analyzes partial technical overlap with the Miasma malware framework and the unrelated prt-scan campaign without making definitive attribution.

wiz.iowriteupAdded 3 Sep 2026, published 14 Jul 2026🛡️ Security

Snyk explains the decades-old symlink attack (CWE-61) and the underappreciated fact that Git will happily commit, push, and recreate symlinks (file mode 120000) from a cloned repo, letting an attacker ship a file like project_settings.json that's secretly a pointer to ~/.ssh/authorized_keys. It walks through Wiz Research's "GhostApproval" report, which found that six AI coding agents (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) can be prompt-injected via README instructions into following such a symlink and writing attacker SSH keys or shell-config payloads before the user ever sees an accurate confirmation dialog (CWE-451, UI misrepresentation). It also recaps prior symlink-driven CVEs (tar npm package CVE-2021-32803, Leaky Vessels CVE-2024-21626, Git submodule CVE-2024-32002) and gives concrete mitigations: canonicalize-then-check-boundary atomically (e.g. openat2 with RESOLVE_BENEATH), show real resolved targets in approval dialogs, and audit repos with `find . -type l` or `git ls-files -s` before trusting them.

snyk.ioarticleAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

Wiz Research discloses GhostApproval, a symlink-following vulnerability (CWE-61) found in six AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — where a malicious repo containing a symlink disguised as a config file tricks the agent into reading/writing sensitive files like ~/.ssh/authorized_keys outside the workspace sandbox. In several tools the agent's internal reasoning correctly identifies the true target file, but the confirmation dialog shown to the user still displays the fake filename (CWE-451, UI misrepresentation), turning human-in-the-loop approval into a rubber stamp; some tools (Amazon Q, Windsurf) even write to disk before the approval prompt appears. AWS (CVE-2026-12958), Google, and Cursor (CVE-2026-50549) shipped fixes; Anthropic initially rejected it as outside threat model before later shipping a symlink warning, Augment acknowledged but hasn't patched, and Windsurf has not responded.

wiz.iowriteupAdded 3 Sep 2026, published 8 Jul 2026🛡️ Security

Wiz Research found that the Amazon Q Developer VS Code extension auto-loaded and executed MCP server configs from .amazonq/mcp.json in a workspace with no consent prompt or workspace-trust check, and spawned those processes with full environment inheritance. Opening a malicious repository (e.g. a malicious PR, typosquatted package, or fake "coding test" per known DPRK social-engineering tactics) could therefore trigger arbitrary code execution and theft of the developer's AWS credentials, demonstrated by capturing aws sts get-caller-identity output. Amazon remediated the issue in language server version 1.65.0, adding a consent prompt before loading workspace MCP servers.

wiz.iowriteupAdded 3 Sep 2026, published 26 Jun 2026🛡️ Security

Wiz Research introduces the Red Agent AI-powered pentester and its new blog series documenting real bug classes it discovers autonomously in production. The launch post shares aggregate stats from a one-month run across roughly 1,000 environments, breaking down dominant failure modes: broken access control, leaked secrets, systemic RCE, SQL injection, PII/PHI exposure, and JWT alg:none bypasses. It teases the series first deep-dive: a GCP Cloud Run SSRF the agent found by iteratively bypassing a GitHub-URL-only validation filter over 96 iterations, escalating to unauthenticated credential and source-code extraction.

wiz.ioarticleAdded 3 Sep 2026, published 17 Jun 2026🛡️ Security

Wiz CIRT and Wiz Research detail JINX-0164, a previously untracked financially-motivated threat actor targeting cryptocurrency organizations since mid-2025. The group uses LinkedIn-based social engineering to deliver macOS malware (the Python-based AUDIOFIX infostealer/RAT and the Go-based MINIRAT backdoor), steals developer and cloud credentials, hijacks Git commits to propagate through CI/CD infrastructure, and trojanized the npm package @velora-dex/sdk in a supply-chain attack. The post includes full IOCs, C2 domains, and detection guidance (e.g., GitHub Vigilant Mode, audit log correlation) and notes tactical overlaps with North Korean clusters like UNC1069/Sapphire Sleet without confirmed attribution.

wiz.iowriteupAdded 5 Sep 2026, published 27 May 2026🛡️ Security

Wiz Research breaks down Jenkins' attack surface using cloud environment telemetry: 59% of Jenkins-using environments have critical core vulnerabilities, 87% run end-of-life instances, and plugins like workflow-cps-global-lib (deprecated, 31% adoption) and extended-choice-parameter (unpatched CVEs, 14% adoption) remain widely deployed despite Jenkins' otherwise mature plugin-governance model. The post maps five recurring attack chains observed in the wild - from exposed script consoles used for cryptojacking, through CI/CD pipeline secret extraction, plugin/core exploitation for controller takeover, agent compromise for lateral movement, to IMDS-based cloud credential theft used by actors like Genesis Panda and IntelBroker to pivot into cloud control planes.

wiz.ioarticleAdded 5 Sep 2026, published 6 May 2026🛡️ Security

Wiz Research's technical breakdown of CVE-2026-3854, a critical vulnerability in GitHub's internal git push pipeline (babeld, gitauth, gitrpcd, pre-receive hook) that let any authenticated user achieve unsandboxed remote code execution with a single `git push -o` command. The root cause is a semicolon-delimiter injection into the internal X-Stat header, chained through unsanitized push options to override security fields (rails_env, custom_hooks_dir, repo_pre_receive_hooks) and escape the custom-hooks sandbox, ultimately giving RCE as the shared git user on GitHub.com's multi-tenant storage nodes and full compromise on GitHub Enterprise Server. Wiz also highlights using AI-augmented reverse engineering (IDA MCP) to rapidly analyze GitHub's closed-source compiled binaries and reconstruct the internal protocol, which enabled the discovery.

wiz.iowriteupAdded 5 Sep 2026, published 28 Apr 2026🛡️ Security

Part one of a Wiz Research series building a threat model for GitHub Actions, covering three core risk classes: dangerous triggers like pull_request_target enabling "Pwn Request" attacks, script/expression injection via unsanitized workflow inputs, and compromised third-party actions in the supply chain. It walks through real incidents including the Trivy supply-chain compromise via a pull_request_target misconfiguration, the Ultralytics PyPI cryptominer injection via branch-name script injection, and the tj-actions/changed-files compromise that hit 22,000 repos targeting Coinbase, with corresponding defenses such as avoiding pull_request_target, binding/sanitizing inputs, and pinning actions to commit SHAs.

wiz.ioarticleAdded 5 Sep 2026, published 14 Apr 2026🛡️ Security