News · BaselineWatch

Wiz blog Tue 27 Oct

PHP2Shell: Exploitation Attempts and Remediation Trends

Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.

Wiz blog Mon 26 Oct

The Pwn Request Reckoning: What Still Works Against GitHub Actions

GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it.

Wiz blog Sun 25 Oct

Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.

Wiz blog Sun 25 Oct

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.

CVE-2026-111497

Wiz blog Thu 22 Oct

ASPM in the AI Era Part 2: Prioritize Exploitable Risks with Code-to-Cloud Context

Reduce triage times and focus on the risks that matter most by combining context across code, infrastructure, and runtime

Wiz blog Thu 22 Oct

ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors

Wiz Research is tracking an ARTEX-using actor, overlapping with Storm-0940, across multiple targeted software vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs.

Wiz blog 21 Oct

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

Wiz blog 21 Oct

LiteLLM Compromised, Steals Credentials

In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a credential stealer targeting browser, cloud and AI secrets as well as a dormant C2 capability.

Wiz blog 20 Oct

Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native.

Enable native runtime protection for GKE in just one click. The Wiz Runtime Sensor add-on now automates deployment and credential management while delivering predictable, kernel-level eBPF threat detection for your GKE Kubernetes fleets.

Wiz blog 20 Oct

From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage

Wiz blog 19 Oct

Supply Chain Zero Days: Closing the Gap Between Publication and Detection

When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published

Wiz blog 19 Oct

Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack

Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them.

Wiz blog 14 Oct

ASPM in the AI Era Part 1: Unified Visibility Across Your Stack

Integrate your existing code scanners into Wiz for a unified view of application risk across your environment.

Wiz blog 14 Oct

Securing the Mission at Machine Speed: Wiz AI Agents Arrive in Wiz for Gov

Wiz AI Agents elevate traditional CNAPP, empowering public sector security teams to accelerate security and innovation.

Wiz blog 7 Oct

How the Wiz Red Agent caught a Fortune 500 firm’s data exposure (that other tools missed)

Traditional DSPM and classification tools scan from the inside out. Thinking like an attacker, the Red Agent found a public page exposing sensitive data in minutes.

Wiz blog 6 Oct

Introducing Wiz AI SAST: Application Security that Understands Your Code and Your Infrastructure

Find, validate, and fix complex business logic flaws with an AI code scanner backed by Wiz Research, operationalized within your existing security program.

Wiz blog 5 Oct

What’s New in Wiz Service Catalog: Smarter Discovery, Governance, and Service-Level Context

Build your Service Catalog faster, keep service context current, and give teams a clearer path from cloud risk to accountability

Wiz blog 30 Sep

Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts

Secure your Kubernetes supply chain with WizOS Helm Charts. Eliminate hidden CI/CD risks and unmaintained dependencies with hardened, signed, and CVE-scanned charts for seamless Kubernetes deployment.

Wiz blog 29 Sep

The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub

See how the Blue Agent investigated a multi-platform attack in minutes, following evidence across AWS and GitHub to uncover compromised credentials, stolen source code, and custom data exfiltration tooling

Wiz blog 28 Sep

Introducing the Wiz Partner Alliance Managed Service Provider Program

Empowering managed services partners to deliver world-class cloud and AI security at scale

Wiz blog 25 Sep

The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments

Wiz Research analyzes NordStellar data to map the credentials targeted by infostealer families and assess their potential impact across cloud, code, and AI environments.

Wiz blog 24 Sep

Wiz Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026

Forrester’s Proactive Security Platforms evaluation rated Wiz with top scores across eight areas, reflecting our commitment to securing the AI era

Wiz blog 24 Sep

Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure

New initiative partners with under-resourced organizations to uncover, remediate exploitable risk at scale.

Wiz blog 22 Sep

Growing the WIN AI Ecosystem with Agent Integrations

WINning AI with AI: How the Wiz MCP for WIN partners accelerates a connected ecosystem

Wiz blog 17 Sep

Exploring the new AWS Sign Up experience

This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.

Wiz blog 17 Sep

Building an AI Detection Engine That Understands Agent Intent

Analyzing model input and output logs in an AI-native detection pipeline to understand and uncover malicious AI agent behavior

Wiz blog 15 Sep

Investing Together: Wiz Defend and Google Security Operations

Continuing to deepen the integration between Wiz Defend and Google Security Operations, helping teams work faster wherever they choose to investigate

Wiz blog 10 Sep

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory (CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329). Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control.

CVE-2026-42016, CVE-2026-42018, CVE-2026-82329

Wiz blog 10 Sep

Wiz achieves GovRAMP High Authorization

Delivering unified cloud security and accelerating secure modernization to protect citizen data and critical infrastructure.

Wiz blog 9 Sep

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft.

Wiz blog 3 Sep

How Developers Prevent Production Risk at the Source

Fixing security vulnerabilities in code takes seconds, while patching in production creates high operational costs and risk. Discover how empowering developers as your first line of defense eliminates exposure across every phase of your software pipeline.

Wiz blog 1 Sep

Introducing Continuous Vulnerability Assessment: Real-Time Defense for the AI Threat Era

Detect exposure to new vulnerabilities the moment they are published with Wiz CVA

Wiz blog 27 Aug

Inside 90 days of attacks on AI infrastructure

Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft.

Wiz blog 27 Aug

From Concept to Context Engine: How Wiz Built AI-Powered Data Discovery

Inside the multi-agent pipeline and feedback loops that turned a bucket scanner into a context engine.

Wiz blog 27 Aug

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services.

Wiz blog 26 Aug

Democratizing FinOps with Wiz: Driving Cost Attribution with the Wiz Service Catalog

How the Wiz Cloud Cost automates cost allocation to power developer-led cost optimization and connect cost to business value.

Wiz blog 26 Aug

The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities

Wiz Research telemetry reveals why the majority of high-severity findings lack a path to compromise

Wiz blog 20 Aug

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios.

Wiz blog 19 Aug

Wiz Penetration Test Findings is now GA

Transform point-in-time pen-tests into continuous exposure management with unified platform combining pen-test findings and real-time cloud context

Wiz blog 18 Aug

How to Spot and Stop Rogue Device Joins

Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attacks.

Wiz blog 18 Aug

Announcing the 2026 Wiz Partner Alliance Award Winners

Recognizing the partners, integrators, and visionaries driving cloud security transformation, AI risk management, and SOC modernization across AMER, EMEA, and ANZ.

Wiz blog 17 Aug

Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR

Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live.

Wiz blog 17 Aug

Wiz blog 6 Aug

Cloud Threat Highlights: H1 2026

Cloud and AI threat activity tracked by Wiz Research and CIRT, January through June 2026

Wiz blog 6 Aug

Wiz Brings Automated DISA STIG Assessment to Amazon Linux 2023 and Windows Server 2025

Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation.

News · Wiz blog