🧰 Wiz

The items that name it 67

• “Black October” for AI Developer Platforms
  writeupas tools2026-10-30

  Wiz Research observed downstream abuse of enterprise credentials traced to the vendor breaches and analysed the Bedrock activity.

• Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
  articleas tools2026-10-29It is written here as Wiz (Google-owned cloud security firm; observed Carbon taking the top spot on web penetration testing benchmarks).

  Google-owned cloud security firm; observed Carbon taking the top spot on web penetration testing benchmarks

• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  articleas classification.technologies2026-10-29
• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  writeupas classification.technologies2026-10-29
• Gemini 4 Carbon
  articleas affected products2026-10-28It is written here as Wiz: Google's cloud security platform; observes Carbon leading on web penetration testing benchmarks, core to its Scan for Good initiative.
• Gemini 4 Carbon: Our next frontier model
  articleas tools2026-10-28It is written here as Wiz: Google's cloud security platform; observes Carbon leading on web penetration testing benchmarks, core to its Scan for Good initiative.
• The Pwn Request Reckoning: What Still Works Against GitHub Actions
  articleas classification.technologies2026-10-26
• alex lee (@alexlee20122022) on X
  threadas classification.technologies2026-10-25
• Prasenjit Sarkar (@stretchcloud) on X
  threadas tools2026-10-24It is written here as Wiz: observed the attacker validating stolen AWS credentials against live infrastructure within four and a half hours of exfiltration.
• Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  articleas classification.technologies2026-10-23
• LiteLLM Compromised in Fresh Supply Chain Attack
  articleas tools2026-10-23It is written here as Wiz: cybersecurity firm that observed attackers abusing stolen credentials about 4.5 hours after exfiltration and querying Amazon Bedrock models.
• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
  articleas classification.technologies2026-10-22
• [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
  articleas classification.technologies2026-10-22
• [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
  articleas classification.technologies2026-10-22
• PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
  articleas classification.technologies2026-10-21
• Remotely exploitable PHP bug found on 70% of world’s websites
  articleas classification.technologies2026-10-21
• Today's PHP security release, and how we're strengthening security
  articleas classification.technologies2026-10-21
• LiteLLM Compromised, Steals Credentials
  writeupas classification.technologies2026-10-21
• PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
  writeupas tools2026-10-21It is written here as Wiz (research).

  Described using the PHPSESSID cookie to leak process memory back to the attacker

• From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
  writeupas classification.technologies2026-10-20
• Supply Chain Zero Days: Closing the Gap Between Publication and Detection
  articleas classification.technologies2026-10-19
• Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack
  writeupas classification.technologies2026-10-19
• [tl;dr sec] #348 - Google's PageBreak Scanner, Perplexity's Agent Security Tool, Defending Agentically
  articleas classification.technologies2026-10-01
• Gemini 4 Is Here, and Google’s Flagship Tops All Other AI Models on Cybersecurity
  articleas classification.technologies2026-09-30
• Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts
  articleas classification.technologies2026-09-30
• The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub
  writeupas classification.technologies2026-09-29
• The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
  writeupas tools2026-09-25It is written here as Wiz (security platform performing the research/integration).

  security platform performing the research/integration

• [tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026
  articleas classification.key entities2026-09-24
• Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure
  articleas classification.technologies2026-09-24
• Top 10 attacks on Claude Code and what each one actually broke
  writeupas tools2026-09-23

  Research team that tested six coding assistants and discovered GhostApproval, the deceptive approval-UI trust boundary gap.

• Building an AI Detection Engine That Understands Agent Intent
  articleas classification.technologies2026-09-17
• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
  articleas tools2026-09-08

  Risk prioritization component of AITD

• Introducing Gemini 3.8 Flash and 3.8 Flash Cyber
  articleas classification.technologies2026-09-02
• From Concept to Context Engine: How Wiz Built AI-Powered Data Discovery
  articleas classification.technologies2026-08-27
• Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps
  articleas classification.technologies2026-08-27
• The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities
  articleas tools2026-08-26

  cloud security platform providing visibility, risk identification, and contextual prioritization of cloud security findings

• FedRAMP 2026 vulnerability rules make reachability a requirement | Blog | Endor Labs
  articleas tools2026-08-26

  CNAPP sensor providing runtime/cloud context to resolve internet-reachability for remaining findings

• Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR
  writeupas classification.technologies2026-08-17
• How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
  writeupas classification.technologies2026-08-13
• Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain
  articleas classification.technologies2026-08-13
• Cloud Threat Highlights: H1 2026
  writeupas tools2026-08-06

  Cloud security platform whose Research and CIRT teams tracked threats, produced this report, drove new/updated detection rules across cloud runtime, identity and supply-chain surfaces, and announced DISA STIG compliance automation and expanded AI-era visibility/response capabilities.

• Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era
  articleas classification.technologies2026-08-03
• Atlasのご紹介：WizのAI脆弱性リサーチャー
  articleas classification.technologies2026-07-27
• Opening the Black Box: Agentless Threat Detection for Virtual Appliances
  writeupas classification.technologies2026-07-22
• Agentless Threat Detection: Illuminating Cloud Blind Spots
  articleas classification.technologies2026-07-21
• AI-Assisted Vulnerability Management
  articleas tools2026-07-18

  Used to map initial cloud footprint (attack surface discovery) in hybrid and cloud environments

• レッドエージェントの視点：B2Bプラットフォームのクレジットシステムを壊したたった1つのブール値
  writeupas classification.technologies2026-07-15
• M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
  writeupas tools2026-07-14

  Detected the attack via automated malicious package monitoring system; added hash-based and package-based detection to its reputation database; publishes advisories via Wiz Threat Intel Center.

• Breaking Down the White House’s Actions on Post-Quantum Cryptography Readiness
  articleas classification.technologies2026-07-02
• XORCISM-AI/XORCISM
  repoas tools2026-07-01

  Cloud security API import connector

• レッドエージェントの視点：航空会社のGraphQL APIにおけるオブジェクトレベルの認可の不備の悪用
  writeupas tools2026-06-29

  Cloud security platform providing visibility into cloud workloads and identifying critical risks (referenced via customer testimonials).

• Red Agentの視点：いかにして推論を重ねてSSRFへと至ったか
  writeupas classification.technologies2026-06-17
• レッドエージェント POVシリーズのご紹介
  articleas classification.technologies2026-06-17
• State of Post Quantum Cryptography | Wiz Blog
  articleas classification.technologies2026-05-28
• FOSSA: Mini-Shai-Hulud Mass Compromise
  writeupas tools2026-05-18

  External security research firm that first reported the attack and identified a bug rendering the payload non-functional for @uipath/* and @mistralai/* npm packages

• Dirty Frag (CVE-2026-43284) Linux Privilege Escalation | Wiz Blog
  advisoryas classification.technologies2026-05-08
• Securing Jenkins: Top Attack Flows & Misconfigurations | Wiz Blog
  articleas tools2026-05-06

  Scans customer Jenkins environments for vulnerabilities and misconfigurations, and monitors attack surface for exposed or exploitable Jenkins instances

• SITF Techniques Library (Wiz)
  toolas classification.technologies2026-05-06
• Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild | Wiz Blog
  advisoryas classification.technologies2026-05-06
• Copy Fail (CVE-2026-31431): Universal Linux Local Privilege Escalation Vulnerability
  advisoryas classification.technologies2026-05-01
• GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog
  writeupas classification.technologies2026-04-28
• Tradecraft Tuesday Recap: axios npm Supply Chain Compromise
  articleas classification.technologies2026-04-21
• Rekt - News or Hype?
  articleas classification.technologies
• Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow Ships
  articleas classification.technologies
• Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
  articleas toolsIt is written here as Wiz (Google-owned).

  Reported on third redundant exfiltration channel via typosquat domain git-tanstack[.]com and PyPI malware behavior differences

• AWS EKS forensics: data sources and investigation tooling (Synacktiv)
  articleas tools

  Third-party runtime security solution improving in-container visibility (mentioned as out of scope for this article)

• AWS EKS Forensics: Data Sources and Investigation Tooling
  articleas tools

  Third-party runtime security solution improving in-container visibility (noted as out of scope for this article)