Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329. Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control...

Wiz achieves GovRAMP High Authorization

Delivering unified cloud security and accelerating secure modernization to protect citizen data and critical infrastructure...

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft...

How Developers Prevent Production Risk at the Source

Fixing security vulnerabilities in code takes seconds, while patching in production creates high operational costs and risk. Discover how empowering developers as your first line of defense eliminates exposure across every phase of your software pipeline...

Introducing Continuous Vulnerability Assessment: Real-Time Defense for the AI Threat Era

Detect exposure to new vulnerabilities the moment they are published with Wiz CVA...

Inside 90 days of attacks on AI infrastructure

Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft...

From Concept to Context Engine: How Wiz Built AI-Powered Data Discovery

Inside the multi-agent pipeline and feedback loops that turned a bucket scanner into a context engine...

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services...

Democratizing FinOps with Wiz: Driving Cost Attribution with the Wiz Service Catalog

How the Wiz Cloud Cost automates cost allocation to power developer-led cost optimization and connect cost to business value...

The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities

Wiz Research telemetry reveals why the majority of high-severity findings lack a path to compromise...

日本のビジネスパーソンを対象としたWiz調査で 「AI導入加速」はクラウド移行を上回ることが明らかに

同時に8割以上がAIによるサイバー攻撃への備えに遅れを感じ、60%がAIセキュリティへの投資を計画...

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate and others executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios...

Wiz Penetration Test Findings is now GA

Transform point-in-time pen-tests into continuous exposure management with unified platform combining pen-test findings and real-time cloud context...

How to Spot and Stop Rogue Device Joins

Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attack...

Announcing the 2026 Wiz Partner Alliance Award Winners

Recognizing the partners, integrators, and visionaries driving cloud security transformation, AI risk management, and SOC modernization across AMER, EMEA, and ANZ...

Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR

Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live...

The Closed Loop Remediation Playbook with Wiz

Start your path to a self-healing cloud today, with Wiz Workflows now GA and Remediation and Response in public preview...

Wiz on Wiz: How the Wiz FinOps Team Uses Wiz Cloud Cost

Powering cost investigation and optimization with deep cloud context...

Securing Data in the AI era

AI is changing the context around data risk, making it critical to understand what’s connected, what’s exposed, and why...

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix...

Inside the Metabase SQLi: Exploited in the Wild

Reverse engineering Metabase CVE-2026-72898 with AI to accelerate defense...

Cloud Threat Highlights: H1 2026

Cloud and AI threat activity tracked by Wiz Research and CIRT, January through June 2026...

Wiz Brings Automated DISA STIG Assessment to Amazon Linux 2023 and Windows Server 2025

Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation...

Wiz at Black Hat 2026: Driving AI Threat Readiness

Announcing new capabilities that help organizations prepare for the AI era by expanding visibility and accelerating response, so security teams can defend at machine speed...

keyv and cacheable npm Package Hijacked in Supply Chain Attack

Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages...

Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era

As AI expands who builds software, the developer workstation is becoming a new security perimeter. AI and third-party software increasingly operate with access to your most sensitive credentials and cloud environments...

S3 Clones in the Neoclouds

S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain...

Rethinking Scanning for the AI Era: Wiz’s Agentic Code Security System

Enterprise AI AppSec requires more than powerful models. It requires a system that balances speed, depth, and cost across the software lifecycle...

CosmosEscape: Taking Over Every Database in Azure Cosmos DB

A critical vulnerability chain in Azure Cosmos DB enabled full read and write access to every Cosmos DB database...

Wiz’s First 6 Months as Part of Google

Fast gets even faster: redefining security for the AI era and doubling down on our multicloud commit...

The Wiz Red Agent is Now Generally Available

Continuously uncover complex, exploitable risks to stay ahead in the AI Threat Era with the Red Agent...

The risk hiding behind exposed MCP servers

How unauthenticated Model Context Protocol MCP servers are opening doors to sensitive cloud data, IAM, and command execution...

Accelerating CISA BOD 26-04 Vulnerability and Triage Activities through Wiz

Wiz enables organizations to continuously assess environments against the CISA KEV catalog, automating risk prioritization, rapid remediation, and forensic triage workflows...

Atlas: Wiz's autonomous AI Agent for vulnerability research, ranked #1 on CyberGym

See how Wiz built Atlas, an autonomous AI system for vulnerability research that validates every finding with a real, working exploit...

Opening the Black Box: Agentless Threat Detection for Virtual Appliances

Mapping appliances event logs to real-world campaigns: A step-by-step researcher’s guide to continuous agentless monitoring...

Agentless Threat Detection: Illuminating Cloud Blind Spots

How Agentless Workload Detection exposes hidden threats in virtual appliances and modern cloud networks...

300 WINtegrations Strong: An Open Security Ecosystem Built for the Speed of AI

As AI accelerates how organizations build and how attackers operate, a deeply connected security ecosystem is how defenders keep up...

Exploitation in the Wild of wp2shell

Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core CVE-2026-63030 & CVE-2026-60137. Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations...

The Red Agent POV: The One Boolean That Broke a B2B Platform’s Credit System

Part 3: How the Red Agent bypassed a credit and paywall system by changing a single client-side value from false to true...

M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

Detect and mitigate malicious @asyncapi npm packages linked to the latest npm supply chain attack...

Why IaC Coverage Belongs on Your Security Dashboard

Rethinking IaC coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed...

How ProdSec uses Wiz

Automation, resilience, and security for the modern age...

Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense

Verizon's latest DBIR highlights how attackers are exploiting familiar weaknesses at increasing speed and scale. Here's what Wiz research reveals about vulnerabilities, trust relationships, and AI in modern cloud environments...

GhostApproval: A Trust Boundary Gap in AI Coding Assistants

Uncovering a category-level blind spot in modern AI coding assistants, and why the Human-in-the-Loop safety model fails against this classic threat...

Wiz ASM for any environment, any risk, everywhere

Protect the modern attack surface with new auto-reconnaissance capabilities, deep internal context, and the Red Agent to find any risk, anywhere...

FAQs from the Field: Is Wiz a Runtime Security Tool?

It's a common question we hear from prospects: "Does Wiz actually do runtime, or is it just risk prevention?" The short answer is yes, Wiz does runtime...

Build AI Security Agents with Wiz MCP

Power AI-driven security with trusted security context, Wiz AI Agents, and Wiz AI Skills...

Breaking Down the White House’s Actions on Post-Quantum Cryptography Readiness

The U.S. Federal Migration to PQC Just Got Real...

Start Secure in the AI Era: Accelerating AI Threat Readiness with WizOS

As the time from vulnerability discovery to exploitation shrinks, building with minimal, secured components is more important than ever. Here is how WizOS helps...