Skip to content

Wiz

feed🛡️ Securitywiz.io ↗

50 posts in the catalog

Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.

wiz.iowriteup

“Black October” for AI Developer Platforms

Wiz Research links October 2026 breaches at AI developer platforms (Fireworks, OpenCode, Warp, Zeabur, Railway and others) to stolen environment-variable credentials for AI access. It details two enterprise AWS Bedrock keys abused after vendor breaches: about 800k and 1.7 million calls, over $100k in list-price usage. It profiles two LLM resale operations, "momo" and "Xingjiabi", that tested the keys.

AWS BedrockOpenCodeClaude+3
LLMjackingdistillationWiz Research+13

Threat Intel, AI Security, Cloud & Infra· 2026-10-30T22:51:44+00:00

wiz.ioarticle

The Rise of Agentic Attacks: What They Look Like, and Where They're Headed

Wiz Research reviews agentic attacks seen in its incident response work and in public reports (ARTEX, Hermes, JPCERT/CC, CrowdStrike, DIVD). It derives fingerprints of AI-agent activity from three intrusions: machine-paced iteration, natural-language reasoning in scripts, self-correcting script versions, checklist enumeration, noisy lateral spraying, probe-before-payload and self-labeled scratch files. It also covers effects on attribution, attack scale and defense.

KubernetesAWSClaude Code+2
ARTEXHermesStorm-0940+12

Threat Intel, Blue Team & Detection, AI Security, Cloud & Infra· 2026-10-29T14:36:22+00:00

wiz.iowriteup

The Rise of Agentic Attacks: What They Look Like, and Where They're Headed

Wiz research on intrusions where AI agents do the hands-on attacker work. It reviews public cases (ARTEX against South Korean banks and the ConnectWise compromise, Hermes at Thailand's Ministry of Finance, JPCERT/CC, CrowdStrike, DIVD) and three Wiz-investigated attacks. It distills fingerprints: machine-paced iteration, embedded natural-language reasoning, self-correcting scripts, checklist enumeration, noisy lateral movement, probe-before-payload habits and self-named scratch files. It also covers attribution, scale and defense implications.

WizKubernetesAWS+2
ARTEXHermesStorm-0940+12

Threat Intel, Blue Team & Detection, AI Security, Cloud & Infra· 2026-10-29T14:26:22+00:00

wiz.ioarticle

PHP2Shell: Exploitation Attempts and Remediation Trends

Wiz Research follow-up on PHP2Shell (CVE-2026-109618, CVE-2026-109619) after the 21 October 2026 disclosure. Honeypot data shows two variants of an open source exploit kit, one stopped by post_max_size and the other by failed memory leaks and worker pinning, plus PHP2Shell-branded tools that rely on session poisoning and LFI. Daily exposed vulnerable machines fell about 67%.

PHPApacheRoundcube
CVE-2026-109618CVE-2026-109619PHP2Shell+7

Threat Intel, Offensive Security· 2026-10-27T13:21:45+00:00

wiz.ioarticle

The Pwn Request Reckoning: What Still Works Against GitHub Actions

The Pwn Request Reckoning is a Wiz post updating the GitHub Actions pull_request_target threat model for 2026. It covers what GitHub's checkout protections, read-only cache tokens and event policies block, and what still works. Remaining paths: SHA-pinned pre-backport actions/checkout, custom checkout scripts, issue_comment and repository_dispatch triggers, script injection, artifact poisoning, self-hosted runner state and allow-unsafe-pr-checkout. It ends with grep and zizmor audit steps.

GitHub ActionsGitHubzizmor+1
pwn requestscript injectionartifact poisoning+2

DevSecOps, AppSec· 2026-10-26T13:24:12+00:00

wiz.iowriteup

Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

Gheist is a campaign tracked by Wiz Research since 15 September 2026 that uses stolen GitHub tokens to push a sync-check workflow on ci-sync-* branches in every reachable repository. The workflow prints base32-encoded secrets into logs, which the tool downloads through the GitHub API and then deletes. Over 13,500 branches from 850+ accounts were recovered. The post covers the two tool variants, a buggy self-hosted runner payload, GitHub's approval hold (which does not cover private repositories), overlaps with other campaigns, hunting queries, IOCs and hardening steps.

GitHubGitHub ActionsAWS+3
GheistGhostActionPolinRider+6

Threat Intel, DevSecOps, Blue Team & Detection· 2026-10-25T17:55:33+00:00

wiz.ioadvisory

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

CVE-2026-111497 (Broccoli2Shell, also Node2Shell and HTTP2Shell) is an out-of-bounds write in the upstream Brotli C decoder. It affects Node.js, Bun, Envoy Proxy, Istio and Python packages, and can lead to memory corruption, information disclosure, crashes or RCE when untrusted Brotli data is decompressed. Wiz reports 91% of cloud environments have vulnerable resources. The post lists patching, inventory, rebuild and temporary mitigation steps.

BrotliNode.jsBun+3
CVE-2026-111497Broccoli2ShellNode2Shell+8

AppSec, Cloud & Infra· 2026-10-25T14:46:53+00:00

wiz.ioarticle

ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors

Wiz Research reports an actor overlapping with Storm-0940 that used ARTEX, an open-source autonomous AI penetration-testing agent, against IT and software vendors in October 2026. It documents source-map and Swagger recon, OAuth callback and unsigned JWT probing, Cognito account-recovery abuse, tenant-isolation tests and Okta/Entra password spraying. The post lists log signals that mark the activity as agentic, such as one-second spray cadence and automatic IP and user-agent rotation.

OktaMicrosoft Entra IDAWS Cognito+3
ARTEXStorm-0940Wiz Research+5

Threat Intel, AI Security, Identity & Access· 2026-10-22T13:05:31+00:00

wiz.iowriteup

LiteLLM Compromised, Steals Credentials

LiteLLM version 1.107.0 was uploaded to PyPI on 21 October 2026 with a credential stealer, and the same build reached GHCR and Docker Hub images. Wiz describes the three dropped files (cook.pth, cook.py, sitecustomize.py), exfiltration to a fake litellm.dev domain, a GitHub dead drop for a second stage, and the malicious commits pushed through the lookalike Berri-AI repository. The last safe version is 1.106.2.

LiteLLMPyPIDocker+3
Berri-AIcook.pthsitecustomize.py+2

Supply Chain, Threat Intel, AI Security· 2026-10-21T13:44:12+00:00

wiz.iowriteup

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

PHP2Shell is Wiz Research's disclosure of memory-safety bugs in core PHP, grouped under two CVEs (up to CVSS 9.2) and fixed in patched releases on 21 October 2026. The post details four bugs, all triggered by out-of-memory fatal errors that leave stale state: an upload-progress unserializer use-after-free, a session-ID memory disclosure, a fatal-error backtrace use-after-free and an OPcache type confusion. It describes unauthenticated RCE on WordPress, Drupal and Joomla, plus detection signals and a disclosure timeline.

PHPWordPressDrupal+3
PHP2ShellWiz ResearchCalif+6

AppSec, Offensive Security, AI Security· 2026-10-21T13:30:59+00:00

wiz.iowriteup

From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

Wiz CIRT investigation of LLMjacking campaigns against Google Cloud billing accounts. Attackers phished admins through malicious Google Search ads and a fake login page that captured MFA codes, then deleted the iam.allowedPolicyMemberDomains policy, added Gmail accounts as billing admins, and linked attacker-controlled projects to the victim's billing account. Victims saw tens to hundreds of thousands of dollars in Gemini API charges within 24 to 48 hours, with no log visibility into prompts. Includes hunting guidance for Workspace, Admin Activity and billing logs.

Google CloudGeminiGoogle Workspace+1
LLMjackingWiz CIRTiam.allowedPolicyMemberDomains+5

Cloud & Infra, Threat Intel, Blue Team & Detection· 2026-10-20T20:03:10+00:00

wiz.ioarticle

Supply Chain Zero Days: Closing the Gap Between Publication and Detection

Wiz describes its pipeline that analyzes every new npm package version at publication, combining static analysis, an AI classifier, sandbox dynamic analysis and runtime sensor observation, then pushes IOCs to Wiz Defend before a CVE exists. It cites supply chain attacks rising from about 10% of significant incidents in H2 2025 to 25% in H1 2026, and the Axios compromise (v1.14.1, v0.30.4). The keyv case shows C2 domains fetched from an Ethereum smart contract, which only runtime monitoring caught.

npmWizEthereum
Axioskeyvcacheable+3

Supply Chain, Blue Team & Detection· 2026-10-19T14:39:29+00:00

wiz.iowriteup

Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack

Wiz CIRT write-up of an AI agent-run intrusion against a multi-cloud organization (GCP, AWS, Kubernetes, CI/CD, GitOps, identity provider). It lists traits of AI-driven attacks: machine-speed tempo, credential chaining, pentest/probe naming, numeric task IDs and commented code. Initial access was a Java RCE in an exposed Kafka UI. It closes with detection and response advice: unified logs, workload visibility and trust isolation.

WizKubernetesAWS+2
Wiz CIRTRed Agentcredential chaining+6

Threat Intel, Blue Team & Detection, Cloud & Infra, AI Security· 2026-10-19T11:26:53+00:00

wiz.ioarticle

Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts

Wiz Research examined the source repositories and CI/CD pipelines behind 1,500 popular Helm charts on Artifact Hub (mapping to 814 unique GitHub repos) and found 61 repos (7.5%) with confirmed supply-chain risk, including 20 charts with CI/CD workflow weaknesses and 25 depending on unmaintained/archived upstream projects. Two disclosed findings illustrate the risk classes: KubeView's go.mod referenced a Go module under a GitHub username that didn't exist, making it hijackable by anyone who registered the name, and Meilisearch's Helm chart repo had a GitHub Actions workflow triggered by PR comments that injected the commenter's branch name into a shell command while skipping author-association checks, letting any GitHub user run commands with a bot token that had push access. The post then pivots to promoting WizOS Helm Charts, Wiz's hardened/signed/CVE-scanned chart catalog built to close these gaps.

KubernetesHelmGitHub Actions+2
KubeViewMeilisearchpwn request+4

Supply Chain, DevSecOps, Cloud & Infra· 2026-09-30T15:52:31+00:00

wiz.iowriteup

The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub

Wiz walks through a case study of its "Blue Agent" autonomous SOC investigator tracing a compromised CI/CD service account (svc_automation) across AWS and GitHub. The attack chain: a stolen GitHub token cloned 18 private repos containing hardcoded AWS keys, which were used to authenticate to AWS from Kali Linux via a Zenlayer VPN IP, pivot to a second account, run SSM SendCommand against a production Windows domain controller, and stage custom Python exfiltration scripts (mssql_table_export.py, pg_table_export.py, billing_export2.py) in S3 to pull data from MSSQL, PostgreSQL, and billing systems. The piece details the investigative technique used - 30-day baseline comparison, ASO/IP dispersion across the tenant, and correlating CloudTrail management-plane events with S3 data-plane events and GitHub audit logs.

AWSGitHubKali Linux+3
AWS IAMSSM SendCommandAssumeRole

Blue Team & Detection, Cloud & Infra· 2026-09-29T12:42:40+00:00

wiz.iowriteup

The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments

Wiz Research analyzed infostealer-harvested secrets (via its NordStellar integration) to map exactly which credentials malware families like Lumma, RedLine, and Vidar target across AWS, Azure, GCP, GitHub, GitLab, and AI platforms, and how those secrets translate into cloud account takeover. It gives concrete file paths and artifacts attackers hunt for (~/.aws/sso/cache OIDC tokens, Azure accessTokens.json, GCP credentials.db/access_tokens.db, GitHub gh hosts.yml and SSH keys, GitLab Runner config.toml, OpenAI/ChatGPT session cookies, and Claude Code's ~/.claude/.credentials.json OAuth tokens), plus stats: three malware families cause 85.7% of incidents, AWS/GCP account for 46%/13% of stolen secrets, GitHub ~10%, AI platforms ~5%. It also covers CI/CD-targeting infostealers (Miasma, TeamPCP) and session-cookie hijacking as an MFA bypass technique.

AWSAzureGCP+3
CVE-2023-7028LummaRedLine+11

Threat Intel, Cloud & Infra, Identity & Access· 2026-09-25T14:51:15+00:00

wiz.ioarticle

Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure

Wiz announces Scan for Good, an initiative that pairs its AI pentester (Red Agent) and Google DeepMind's Gemini 3.8 Flash Cyber with human researchers. It scans authorized public-facing services of critical infrastructure, hospitals, municipalities and nonprofits for exposures and attack paths. It lists anonymized findings, including an exposed admin key over an 8.8M-file archive, NoSQL injection at an AI training-data platform, unsafe upload to hospital server control, and public CI/CD workflows leaking credentials. It also sets out the authorization, human-validation and private-disclosure rules.

WizGemini
Scan for GoodRed AgentWiz Research+10

AI Security, Offensive Security, Cloud & Infra· 2026-09-24T13:00:03+00:00

wiz.iowriteup

Exploring the new AWS Sign Up experience

Wiz researchers reverse-engineered AWS's new sign-up experience, which silently creates a three-account AWS Organization (management, identity, and a restricted sandbox member account) with Builder ID login instead of root credentials. They found the sandbox blocks security services like GuardDuty, SecurityHub, Detective, Inspector, Macie and Access Analyzer via an allowlist SCP (FreeTierSCP), while still permitting risky practices such as IAM user access keys, public S3 buckets, and IMDSv1 EC2 instances; a data-perimeter RCP also blocks cross-account sts:AssumeRole until the account is upgraded, potentially pushing vendors back toward IAM user keys. The new IAM Role Manager feature further undermines least privilege by auto-attaching PowerUserAccess to console-created roles.

AWSAWS IAM
Control TowerAccountFullAccessRoleAWSManagedAccountManagementAccessRole+7

Cloud & Infra, Identity & Access· 2026-09-17T14:25:30+00:00

wiz.ioarticle

Building an AI Detection Engine That Understands Agent Intent

Wiz describes an AI detection engine that analyzes model input/output telemetry (prompts, system prompts, tool calls, reasoning) rather than just outputs, in order to catch shifts in AI agent intent such as indirect prompt injection. It walks through OpenAI's disclosed Hugging Face/ExploitGym incident and an internal support-agent phishing-relay scenario, then describes a staged pipeline (regex/SLM candidation, light LLM filtering, deep LLM analysis, correlation with cloud/runtime telemetry) validated against a benchmark of 100+ simulated scenarios covering 57 injected attacks and 45 benign workflows across CI/CD, DevOps, data analyst, support, CLI, and cloud auditor agent personas.

WizOpenAIHugging Face+1
ExploitGym

AI Security, Blue Team & Detection· 2026-09-17T14:04:47+00:00

wiz.ioadvisory

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Wiz Research documents active in-the-wild exploitation of three JFrog Artifactory vulnerabilities: CVE-2026-42018 (exposes an internal anonymous-user JWT via POST /access/api/v1/aws/token/), CVE-2026-42016 (token scope validation flaw allowing that JWT to be escalated to admin via POST /access/api/v1/tokens), and CVE-2026-82329 (unauthenticated admin access via POST /access/api/v1/registry/join, added to CISA KEV). Attackers chained the first two to create persistent admin accounts, deploy malicious Groovy plugins for RCE, and drop Rust-based C2 backdoors, while CVE-2026-82329 was exploited independently for configuration exfiltration, cluster join-key theft, and credential/SSH-key persistence. The post includes exact request sequences, detection signatures, affected/fixed version ranges, and remediation guidance.

JFrog ArtifactoryRust
CVE-2026-42016CVE-2026-42018CVE-2026-82329+1

AppSec, Threat Intel, Blue Team & Detection· 2026-09-10T19:04:00+00:00

wiz.iowriteup

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz researchers chain three LiteLLM flaws into a full pre-auth-to-cloud-compromise path: an MCP endpoint authentication bypass (CVE-2026-59822) that grants a session with any garbage Bearer token, a custom-code-guardrail sandbox bypass leading to root RCE (CVE-2026-59821) via exec() on unsanitized admin-submitted Python, and a config-endpoint authorization gap (CVE-2026-35029). They also show pass-through endpoints can be pointed at the AWS IMDS to steal IAM credentials, bypassing IMDSv2 via header-prefix forwarding. A scan of ~3,074 internet-facing instances found 9.6% accepting the default sk-1234 master key or no auth at all, and CVE-2026-59822 is now in CISA's KEV catalog with observed in-the-wild exploitation.

LiteLLMModel Context ProtocolAWS+3
CVE-2026-59822CVE-2026-59821CVE-2026-35029+1

AI Security, AppSec, Cloud & Infra· 2026-09-09T16:06:00+00:00

wiz.iowriteup

Inside 90 days of attacks on AI infrastructure

Wiz Threat Research ran honeypots across LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama and other AI/ML services for 90 days, capturing active exploitation of an MCP Gateway auth bypass (CVE-2026-59822) and an MCP server test-endpoint command injection (CVE-2026-42271, in CISA KEV, chainable with Starlette CVE-2026-48710 for unauthenticated RCE and linked to Qilin ransomware exploitation) used to deploy fileless cryptominers. It also documents blind prompt injection campaigns against LangChain, Flowise, OpenWebUI, and Node-RED agents that trigger OS command execution confirmed via out-of-band DNS callbacks to OAST domains.

LiteLLMLangChainFlowise+3
CVE-2026-59822CVE-2026-42271CVE-2026-48710+2

Threat Intel, Offensive Security, AI Security· 2026-08-27T16:33:16+00:00

wiz.ioarticle

From Concept to Context Engine: How Wiz Built AI-Powered Data Discovery

Wiz describes the evolution of its public bucket scanner into an AI-powered "context engine" for data security posture management (DSPM): a multi-agent pipeline where lightweight models triage files and larger models perform deep content analysis, iteratively learning bucket-specific patterns to find sensitive data that regex-based scanners miss. The production system adds structured severity scoring, synthetic/test-data filtering, algorithmic file clustering for scale, and now powers classification across cloud storage, cloud drives, endpoints, and Wiz's Red Agent attack-simulation findings. A one-week scan of public buckets using the engine surfaced over 2,700 sensitive data findings, including correlated credential/schema/export file sets that regex tools would treat as unrelated.

Wiz
Red Agent

AI Security, Cloud & Infra· 2026-08-27T15:52:01+00:00

wiz.ioarticle

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

Wiz CIRT published a DFIR cheatsheet/poster covering the four most common version control platforms (GitHub, GitLab, Bitbucket Cloud/Data Center, Azure DevOps), detailing available log sources, default retention limits (e.g. GitHub's 7-day Git read/write event retention, GitLab not storing Git operations by default), a pre-incident configuration checklist (enabling source-IP metadata, extending retention, log streaming), and a MITRE ATT&CK-mapped matrix of platform-specific audit event names to hunt for during investigations. It illustrates the gaps with a real incident where a compromised token was used to mass-clone repositories containing plaintext secrets, and shows how the same action (e.g. mass repo cloning) surfaces under different event names per platform (git.clone in GitHub, repository_git_operation in GitLab, RepositoryCloneEvent in Bitbucket Data Center).

GitHubGitLabAzure DevOps+2
TeamPCP

Blue Team & Detection, Supply Chain· 2026-08-27T12:00:00+00:00

wiz.ioarticle

The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities

Wiz Research's blog summary of its "State of Cloud Security Risk 2026" report finds that most high-severity cloud security alerts are not real attacker opportunities once environmental context (external reachability, toxic permission combinations, sensitive data access) is applied, eliminating over half of flagged findings. Key data points include the average vulnerability-to-exploitation window shrinking to 21.5 days (per Wiz's ZeroDayClock tracking), 30% of cloud environments containing an externally exposed machine tied to high-impact lateral movement paths, and software RCE accounting for only 9% of exploitable findings versus access/credential/secrets pathways.

Wiz
ZeroDayClock

Cloud & Infra· 2026-08-26T15:01:58+00:00

wiz.iowriteup

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Wiz researchers found that malicious versions of the Rust crates arrayref, internment, and append-only-vec were published to crates.io, each pulling in a typosquatted build-dependency (proc-macro1, mimicking proc-macro2) whose build.rs executes a remote payload at compile time. The payload beacons to a C2 endpoint (/49890878) shared with the Mastra campaign, disables TLS validation, enumerates Chrome/Brave/Edge saved logins via their SQLite stores, persists via Registry Run keys/LaunchAgents/systemd, and falls back to a DGA — with C2 infrastructure and SSL-issuer overlap tying it to DPRK/Sapphire Sleet activity previously seen in the Mastra and axios supply chain attacks. arrayref is used in roughly 75% of Rust environments, making this a high-impact build-time compromise.

RustCargocrates.io+3
arrayrefinternmentappend-only-vec+5

Supply Chain, Threat Intel, Malware & RE· 2026-08-20T15:56:39+00:00

wiz.iowriteup

How to Spot and Stop Rogue Device Joins

Wiz details how attackers abuse Entra ID's Device Registration Service to register rogue devices — often via device code phishing — to satisfy Conditional Access policies requiring joined devices, commonly using the open-source ROADrecon framework and predictable names like DESKTOP-XXXXXXXX. As attackers shift to AI-generated, benign-looking device names (e.g., "Work PC") and plausible User-Agent strings, static IOC matching breaks down, so Wiz shifted to behavioral detections: naming-convention anomaly detection against tenant baselines and correlating device-code-phishing alerts with subsequent device registrations, including a shared KQL query for identifying anomalous naming baselines.

Microsoft Entra IDMicrosoft 365Azure+3
device code phishingAiTMlockwall.xyz+1

Identity & Access, Blue Team & Detection, AI Security· 2026-08-18T16:24:13+00:00

wiz.iowriteup

Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR

Wiz's autonomous "Red Agent" discovered a GitHub Actions script-injection vulnerability in snowflakedb/snowflake-connector-net's jira_issue.yml workflow, introduced when a PR (co-authored by GitHub Copilot) replaced a safe env:/jq pattern with direct interpolation of the attacker-controlled issue title. GitHub Advanced Security scanned the same PR and workflow but failed to flag the injection; Red Agent autonomously crafted and self-corrected a payload after a bash syntax error, exfiltrated Jira OAuth credentials via an out-of-band callback, and used them to access Snowflake's internal Jira (engineering, security, and bug-bounty projects) — all without human intervention. Snowflake patched and rotated credentials the same day the flaw was reported via HackerOne.

GitHub ActionsGitHub Advanced SecurityGitHub Copilot+3
Red AgentWiz Research

DevSecOps, AI Security, Offensive Security· 2026-08-17T14:00:00+00:00

wiz.iowriteup

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

Wiz's Customer Incident Response Team (CIRT) details a real campaign (mid-May–early June 2026) in which stolen GitHub Personal Access Tokens were used for repository reconnaissance, low-volume validation cloning, and then mass exfiltration of thousands of repos per organization from AWS IPs using automated tooling. The post provides a structured investigation playbook — containing the compromised PAT, expanding the timeline via GitHub audit logs and Enterprise Log Streaming, tracing the leak source, assessing blast radius (exposed secrets/PII in exfiltrated repos), rotating credentials, and hunting for downstream cloud abuse — while noting GitHub's 7-day audit log retention limits visibility.

GitHubAWSWiz+1
Wiz CIRT

Blue Team & Detection, Threat Intel, Identity & Access· 2026-08-13T15:04:28+00:00

wiz.ioarticle

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

Wiz research blog on how developers' personal public GitHub repositories create a secrets-exposure blind spot outside org security boundaries, citing that 65% of the Forbes AI 50 had verified secret leaks and 56% of company-impacting secrets lived in personal repos, often granting infrastructure-level access (cloud credentials, CI/CD tokens, AI service keys). It describes Wiz Code's approach: inventorying developer identities to discover the personal repos they own, mapping leaked secrets to attack paths on the Wiz Security Graph, and using an AI-driven "Red Agent" to validate exploitability before triggering rotation/remediation workflows.

WizGitHub
Wiz ResearchRed Agent

DevSecOps, Supply Chain· 2026-08-13T13:48:56+00:00

wiz.iowriteup

Inside the Metabase SQLi: Exploited in the Wild

Wiz Research reverse-engineers CVE-2026-72898 (GHSA-vwf4-m7j8-wcjf), a zero-day SQL injection in Metabase's /api/session/reset_password endpoint exploited in the wild against Metabase Cloud since August 2026. The bug chains Clojure's merge (which lets an attacker-supplied user-id survive an auth-result merge), JSON keywordization, and HoneySQL's :raw keyword to smuggle unparameterized SQL into a t2/select-one query, yielding blind SQL injection. The post walks through decompiling patched vs. vulnerable JARs to reconstruct the flaw, notes ~2,500 internet-exposed Metabase instances per Shodan, and gives a curl-based exploitability check plus remediation guidance.

MetabaseClojureHoneySQL+2
CVE-2026-72898GHSA-vwf4-m7j8-wcjfWiz Research

AppSec· 2026-08-10T12:30:17+00:00

wiz.iowriteup

Cloud Threat Highlights: H1 2026

Wiz's H1 2026 cloud threat report documents a 60% jump in significant incidents driven by a doubling of supply-chain attacks (TeamPCP's npm/PyPI/GitHub Actions credential-harvesting spree, its open-sourced Shai-Hulud worm spawning Miasma/Hades/Megalodon/IronWorm follow-ons, North Korea's axios and @mastra trojanizations) and by growing attacks on AI infrastructure, including exposed unauthenticated MCP servers, LiteLLM/Dify/Langflow/n8n/Ollama vulnerabilities, and cryptominers deployed via a Langflow RCE. It also profiles JINX-0163, a cloud-native extortion group targeting non-human identities (service accounts/IAM roles) across AWS/Azure/GCP/Okta/Snowflake linked to the "FulcrumSec" extortion brand, and closes with concrete detection techniques for stolen access keys, Kubernetes VM Run Command abuse, GCP org-policy tampering, and CloudTrail user-agent/boto3 credential-provenance mismatches.

npmPyPILiteLLM+3
TeamPCPShai-HuludMiasma+11

Supply Chain, Threat Intel, AI Security, Cloud & Infra· 2026-08-06T14:03:03+00:00

wiz.iowriteup

keyv and cacheable npm Package Hijacked in Supply Chain Attack

Wiz Research documents an ongoing supply chain attack in which a compromised GitHub maintainer account was used to publish malicious versions of keyv, cacheable, and 400+ dependent npm packages. The payload is a variant of the open-sourced 'Mini' Shai-Hulud malware (linked to the TeamPCP and antv campaigns) that steals cloud, CI/CD, AI-agent, and cryptocurrency credentials, persists via Claude Code hooks and VS Code tasks.json, exfiltrates data to attacker-controlled GitHub repos, and retrieves its C2 domain dynamically via an Ethereum smart contract (StringListStore) eth_call rather than hardcoding it.

npmGitHubEthereum+3
Shai-HuludMini Shai-HuludTeamPCP+6

Supply Chain, Threat Intel, Malware & RE· 2026-08-04T11:25:22+00:00

wiz.ioarticle

Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era

Wiz announces a new endpoint sensor for developer workstations (Windows/macOS, private preview) that inventories packages, IDE extensions, AI coding agents, and MCP servers, and detects known/emerging supply chain attacks in real time. The post details three real-world campaigns that motivated it: Shai-Hulud (a self-propagating npm worm that ran TruffleHog via postinstall scripts to steal npm tokens and republish itself), the Axios backdoor (a compromised maintainer account injecting C2-calling code executed within 1.1 seconds of npm install), and s1ngularity (a compromised Nx build system/VS Code extension that harvested GitHub/npm/SSH/cloud credentials and weaponized local AI CLI tools like Claude and Gemini to exfiltrate filesystem data, leaking 1,000+ GitHub tokens and exposing 5,500 private repos).

npmWizNx+3
Shai-Huluds1ngularityAxios npm backdoor

Supply Chain, DevSecOps, AI Security· 2026-08-03T14:02:36+00:00

wiz.iowriteup

S3 Clones in the Neoclouds

Wiz Research examines S3-compatible object storage offerings from Nebius, Vultr, Lambda Labs, Cloudflare R2, DigitalOcean, and Crusoe, showing how each deviates from AWS S3 security defaults. Findings include providers that expose access/secret keys via list APIs (Vultr), default ACLs that would be public but aren't enforced (Lambda Labs), lack of least-privilege key scoping (Vultr, Crusoe, Lambda Labs), weak or undocumented encryption-at-rest/TLS enforcement, unstructured access-key formats that evade GitHub/secret-scanner detection, and cross-tenant bucket namesquatting risk due to shared global namespaces.

AWSCloudflareDigitalOcean+3
bucket namesquatting

Cloud & Infra· 2026-07-31T13:48:07+00:00

wiz.iowriteup

CosmosEscape: Taking Over Every Database in Azure Cosmos DB

Wiz Research found CosmosEscape, a critical Azure Cosmos DB vulnerability exploited via the Gremlin API's .NET-based query engine, whose sandbox failed to restrict .NET reflection, enabling arbitrary code execution on the DB Gateway service. This allowed retrieval of the "Cosmos Master Key," a platform-wide signing key that could fetch any Cosmos DB account's primary key and enumerate accounts via a shared Config Store, enabling attackers to compromise any customer or internal Microsoft database (including those backing Entra ID, Teams, and Copilot) from public endpoints. Microsoft fully remediated the issue and eliminated the master key architecture.

Azure Cosmos DBGremlin.NET+1
CosmosEscapeCosmos Master KeyConfig Store+1

Cloud & Infra, Offensive Security· 2026-07-30T12:00:01+00:00

wiz.iowriteup

The risk hiding behind exposed MCP servers

Wiz Research scanned MCP servers across cloud environments and found roughly 1 in 6 environments expose at least one server to the Internet, most unauthenticated and still running the pre-auth 2024-11-05 protocol version. They demonstrate anonymous tool-catalog enumeration, real data returned from production databases/CRM/IAM backends, write/delete-capable tools, and confirmed SSRF against cloud instance metadata endpoints yielding temporary credentials, plus agents that can be talked into unsafe actions by reframing requests as "routine maintenance."

Model Context ProtocolAWSOAuth
Wiz ResearchSSRFinstance metadata service

AI Security, Cloud & Infra, AppSec· 2026-07-28T15:58:22+00:00

wiz.ioarticle

Atlasのご紹介：WizのAI脆弱性リサーチャー

Wiz Research details Atlas, an autonomous multi-agent AI system for vulnerability discovery that ranks #1 on the CyberGym benchmark (90.9% success) and found 200+ previously unknown bugs in heavily audited projects like grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd. The post explains Atlas's four-stage pipeline (attack-surface mapping via code property graphs, parallel hypothesis hunting, adversarial validation between competing agents, and dynamic exploit triggering) and notes an early version of the system contributed to discovering a critical GitHub RCE (CVE-2026-3854) that paid GitHub's largest-ever bug bounty. It also outlines lessons from evaluation-driven development and plans to integrate Atlas into Wiz Code alongside Google CodeMender.

WizKubernetesLinux kernel+1
CVE-2026-3854CyberGymWiz Research

AI Security, AppSec· 2026-07-27T14:00:02+00:00

wiz.iowriteup

Opening the Black Box: Agentless Threat Detection for Virtual Appliances

Wiz details how its Agentless Workload Detection extends EDR-like visibility to FortiGate firewalls by parsing local FortiOS logs (log IDs like 32001/32002/44547/41987) to hunt for credential stuffing, rogue admin account creation, certificate manipulation, NAT/port-forwarding abuse, and FortiManager script abuse. It maps these techniques to real-world campaigns including the FortiBleed credential-compromise campaign, active exploitation of CVE-2026-24858, and UNC3886's use of CVE-2022-41328 to deploy the CASTLETAP backdoor, plus Salt Typhoon's exploitation of CVE-2023-48788 against FortiClient EMS.

FortiGateFortiManagerWiz+3
CVE-2026-24858CVE-2024-55591CVE-2024-23113+8

Blue Team & Detection, Threat Intel, Cloud & Infra· 2026-07-22T14:24:50+00:00

wiz.ioarticle

Agentless Threat Detection: Illuminating Cloud Blind Spots

Wiz Research details how its Agentless Workload Detection uncovered active exploitation across a range of cloud/network appliances and services: FortiGate zero-day account creation (CVE-2026-24858), FortiBleed credential stuffing against ~75,000 devices, PAN-OS admin-account compromise (CVE-2026-0257) and CaptivePortal exploitation (CVE-2026-0300), a critical pre-auth BeyondTrust RCE (CVE-2026-1731), the memory-disclosure bug MongoBleed (CVE-2025-14847), Redis replication-abuse for RCE, a Zabbix instance compromised via default credentials, a Linux page-cache LPE called CopyFail, malicious npm package installs (@asyncapi/specs), and WordPress wp2shell webshells (CVE-2026-63030, CVE-2026-60137). It illustrates concrete detection logic (e.g. Redis replication target rules, unusual-executable HTTP access detections) built from agent-free log collection on virtual appliances that traditionally lacked EDR coverage.

WizFortiGateRedis+3
CVE-2026-24858CVE-2026-0257CVE-2026-0300+9

Blue Team & Detection, Cloud & Infra, Threat Intel· 2026-07-21T13:26:13+00:00

wiz.iowriteup

Exploitation in the Wild of wp2shell

Wiz Research documents active in-the-wild exploitation of "wp2shell," a pre-auth RCE chain in WordPress Core (CVE-2026-63030 and CVE-2026-60137) affecting every WordPress version since December 2025, discovered by Searchlight Cyber using GPT-5.6 Sol. Attackers abuse the WordPress REST API batch endpoint (/wp-json/batch/v1) to achieve unauthenticated RCE, then deploy malicious plugins/webshells (including a disguised "CMSmap" plugin and a custom REST endpoint backdoor), enumerate users, and attempt LFI against wp-config for credential theft. The post details post-exploitation TTPs, detection signatures (HTTP 207 responses, wp2shell/rezwp2shell user agents), IOCs, and WAF/plugin-based mitigations.

WordPressPHP
CVE-2026-63030CVE-2026-60137wp2shell+5

Threat Intel, AppSec· 2026-07-20T18:00:08+00:00

wiz.iowriteup

レッドエージェントの視点：B2Bプラットフォームのクレジットシステムを壊したたった1つのブール値

Wiz's autonomous "Red Agent" AI pentester analyzed a B2B data platform's 130MB of frontend JS bundles, extracted 100+ API endpoints, and found an unused boolean flag (e.g. unmaskContactData) referenced in client code but never sent by the normal UI. Replaying a standard free-tier search request with this flag set to true caused the backend to skip credit/tier checks and return fully unmasked business emails and phone numbers for the platform's 600M+ profiles, letting free-tier users bypass the paywall entirely; the vendor fixed the flaw within two hours of disclosure.

Wiz
Red Agent

AppSec, AI Security, Offensive Security· 2026-07-15T13:33:42+00:00

wiz.iowriteup

M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

Wiz Research details how an attacker used 37 decoy pull requests to mask exploitation of a pull_request_target "pwn request" misconfiguration in the asyncapi/generator GitHub Actions workflow, stealing a privileged PAT belonging to the asyncapi-bot service account. The attacker then published four malicious npm packages (five versions) under the @asyncapi namespace with over 3 million weekly downloads, delivering a self-identified "M-RED-TEAM v6.4" multi-stage payload that fetches an 8.25MB encrypted bundle from IPFS and installs a 92,000-line trojan framework with systemd persistence and HTTP/Nostr/Ethereum/libp2p C2 channels, targeting browser credentials, SSH keys, npm/GitHub tokens, AWS credentials, and crypto wallets. The piece also analyzes partial technical overlap with the Miasma malware framework and the unrelated prt-scan campaign without making definitive attribution.

GitHub ActionsnpmEthereum+3
M-RED-TEAMAsyncAPIShai-Hulud 2.0+4

Supply Chain, DevSecOps, Threat Intel· 2026-07-14T10:33:36+00:00

wiz.iowriteup

GhostApproval: A Trust Boundary Gap in AI Coding Assistants

Wiz Research discloses GhostApproval, a symlink-following vulnerability (CWE-61) found in six AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — where a malicious repo containing a symlink disguised as a config file tricks the agent into reading/writing sensitive files like ~/.ssh/authorized_keys outside the workspace sandbox. In several tools the agent's internal reasoning correctly identifies the true target file, but the confirmation dialog shown to the user still displays the fake filename (CWE-451, UI misrepresentation), turning human-in-the-loop approval into a rubber stamp; some tools (Amazon Q, Windsurf) even write to disk before the approval prompt appears. AWS (CVE-2026-12958), Google, and Cursor (CVE-2026-50549) shipped fixes; Anthropic initially rejected it as outside threat model before later shipping a symlink warning, Augment acknowledged but hasn't patched, and Windsurf has not responded.

Claude CodeCursorWindsurf+4
GhostApprovalCVE-2026-12958CVE-2026-50549+2

AI Security, AppSec· 2026-07-08T14:00:00+00:00

wiz.ioarticle

Breaking Down the White House’s Actions on Post-Quantum Cryptography Readiness

Wiz breaks down Executive Order 14409 ('Securing the Nation Against Advanced Cryptographic Attacks') and OMB memorandum M-26-15, which set accelerated federal deadlines for migrating High Value Assets and High Impact Systems to NIST-approved post-quantum cryptography (key establishment by 2030, digital signatures by 2031). It covers requirements for automated cryptographic inventories, forthcoming NIST/CISA Cryptographic Bill of Materials (CBOM) guidance, Harvest-Now-Decrypt-Later risk prioritization, FedRAMP/FAR Council contractor compliance rules, and comparable international timelines (EU, Japan, Australia, India), before pitching Wiz's own CBOM/PQC readiness tooling.

Wiz
Executive Order 14409M-26-15FAR Council+3

GRC· 2026-07-02T01:48:01+00:00

wiz.iowriteup

レッドエージェントの視点：航空会社のGraphQL APIにおけるオブジェクトレベルの認可の不備の悪用

Wiz details how its autonomous "Red Agent" AI red-teaming tool found a critical Broken Object-Level Authorization (BOLA) flaw in an unnamed airline's GraphQL booking API. Starting from just a root URL, the agent reverse-engineered client JS to mint an anonymous session token, ran GraphQL introspection to enumerate 514 queries/428 mutations, and found that mutations like bookingRetrieveByBookingId accepted sequential integer IDs with no backend authorization check — exposing full passenger PII, payment data, and write access to bookings within 15 minutes.

GraphQLWiz
Red AgentBOLAOWASP API Security Top 10

AppSec, AI Security· 2026-06-29T09:31:40+00:00

wiz.iowriteup

MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension

Wiz Research found that the Amazon Q Developer VS Code extension auto-loaded and executed MCP server configs from .amazonq/mcp.json in a workspace with no consent prompt or workspace-trust check, and spawned those processes with full environment inheritance. Opening a malicious repository (e.g. a malicious PR, typosquatted package, or fake "coding test" per known DPRK social-engineering tactics) could therefore trigger arbitrary code execution and theft of the developer's AWS credentials, demonstrated by capturing aws sts get-caller-identity output. Amazon remediated the issue in language server version 1.65.0, adding a consent prompt before loading workspace MCP servers.

Amazon Q DeveloperVS CodeModel Context Protocol+1
Wiz ResearchDPRK

AI Security, Cloud & Infra· 2026-06-26T12:00:01+00:00

wiz.iowriteup

Red Agentの視点：いかにして推論を重ねてSSRFへと至ったか

Wiz walks through how its autonomous 'Red Agent' AI pentesting tool chained an SSRF vulnerability in a GCP Cloud Run service's ?url= file-fetch parameter into a full local file read, bypassing a strict GitHub-blob-URL validator. The breakthrough payload (github.com/x/y/blob/z//proc/self/environ) exploited a parser differential between the validator and the fetcher, letting the agent exfiltrate live GCP service-account credentials and the app's source code after 96 requests of iterative hypothesis-driven probing.

GCPWiz
Red AgentSSRFpath traversal

AppSec, AI Security, Cloud & Infra· 2026-06-17T14:33:51+00:00

wiz.ioarticle

レッドエージェント POVシリーズのご紹介

Wiz Research introduces the Red Agent AI-powered pentester and its new blog series documenting real bug classes it discovers autonomously in production. The launch post shares aggregate stats from a one-month run across roughly 1,000 environments, breaking down dominant failure modes: broken access control, leaked secrets, systemic RCE, SQL injection, PII/PHI exposure, and JWT alg:none bypasses. It teases the series first deep-dive: a GCP Cloud Run SSRF the agent found by iteratively bypassing a GitHub-URL-only validation filter over 96 iterations, escalating to unauthenticated credential and source-code extraction.

WizGCP
Red AgentWiz ResearchJWT alg:none+1

AI Security, AppSec, Offensive Security· 2026-06-17T14:33:41+00:00