Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign

LiteLLM is the latest victim of TeamPCP’s open-source attack spree. Malicious versions 1.82.7 and 1.82.8 abuse Python’s .pth mechanism for stealthy persistence. The malware exfiltrates cloud credentials, CI/CD secrets, and keys to attacker-controlled domains...

Wiz becomes the first CNAPP to provide AI Security Posture Management

Wiz extends its platform to secure AI with AI-SPM capabilities, helping organizations accelerate their AI innovation in the cloud...

Bridging the Security Gap: Mitigating Lateral Movement Risks from On-Premises to Cloud Environments

This blog post will discuss lateral movement risks from on-prem to the cloud. We will explain attacker TTPs, and outline best practices for cloud builders and defenders to help secure their cloud environments and mitigate risk...

#BrokenSesame: Accidental ‘write’ permissions to private registry allowed potential RCE to Alibaba Cloud Database Services

A container escape vulnerability, combined with accidental 'write' permissions to a private registry, opened a backdoor for Wiz Research to access Alibaba Cloud databases and potentially compromise its services through a supply-chain attack...

$100M ARR in 18 months: Wiz becomes the fastest-growing software company ever

Just two years since its launch, Wiz protects hundreds of the world’s leading organizations by enabling them to build faster and more securely in the cloud...

Log4Shell 10 days later: Enterprises halfway through patching

Wiz and EY Ernest & Young analyzed more than 200 enterprise cloud environments with thousands of cloud accounts. The results were striking: While 93% of all cloud environments are at risk from Log4Shell, on average organizations have patched 45% of their vulnerable cloud resources by Day 10...

Wiz integrates with the new Amazon Inspector for enhanced security insights, context, and accuracy

Wiz is excited to announce it is a launch partner for the new Amazon Inspector, bringing Amazon Inspector findings together with Wiz insights to give our customers actionable, prioritized and contextually rich security insights...

Wiz achieves GovRAMP High Authorization

Delivering unified cloud security and accelerating secure modernization to protect citizen data and critical infrastructure...

Wiz at Black Hat 2026: Driving AI Threat Readiness

Announcing new capabilities that help organizations prepare for the AI era by expanding visibility and accelerating response, so security teams can defend at machine speed...

The Borderless Attack Surface: Securing Public Sector Hybrid Environments

Aligning Modern CNAPP Telemetry with realistic risk assessments to drive agency efficiency through cross-team collaboration...

AI Threat Readiness Pillar 3: Perform AI Code Analysis Natively in Wiz

Your guide to operationalizing AI-powered code analysis with Wiz to stay ahead of AI driven development and adversaries...

durabletask: TeamPCP's Latest PyPi Compromise

Discover the latest on malicious versions of the pypi package durabletask, matching TeamPCP tactics...

From Cryptographic Blind Spots to Post-Quantum Agility: Introducing Wiz for PQC Readiness

Eliminate cryptographic blind spots and neutralize legacy debt with an integrated cryptographic asset inventory. Identify risks across code, cloud, and runtime, using the Wiz Security Graph to prioritize migration and protect against "Harvest Now, Decrypt Later" attacks...

The Jenkins Threat Landscape

What usage patterns, plugin adoption, and configuration choices reveal about the Jenkins attack surface...

Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware

Detect and mitigate malicious npm packages linked to the recent Shai-Hulud-style campaign - Mini Shai Hulud...

Closing the Security Gap in the Age of Agentic Coding

AI agents are writing more and more code. Ensure it's secure. Learn how Wiz Code plugins and the Green Agent bring machine-speed remediation to your AI-IDE...

React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182

We break down the exploit mechanics and detail active in-the-wild attacks observed by our team, from credential harvesting to sophisticated cloud backdoors...

Critical vulnerabilities in NetScaler ADC exploited in-the-wild: everything you need to know

Detect and mitigate CVE-2025-5349, CVE-2025-5777, and CVE-2025-6543, Citrix Netscaler ADC and Gateway vulnerabilities being exploited in the wild. Organizations should patch urgently...

2025 Cloud Security Predictions: Trends to Look Out for

Wizards share some of the cloud security trends to look out for in 2025...

Expanding coverage with Linux runtime

Wiz announces its Runtime Sensor for Linux, expanding coverage of threat detection and response for cloud workloads...

New attack vectors in EKS

We explore how advancements in EKS Access Entries and Pod Identity have opened new attack vectors and offer examples of how adversaries could exploit them...

Eight questions to measure vulnerability remediation "pain"

What is it about certain vulnerabilities that makes them especially hard to deal with, and how can vendors make things easier for security teams?...

Wiz is the #1 Cloud Security Company on the 2023 Forbes Cloud 100

Wiz is the 1 cloud security company on the list and one of the biggest movers from last year, alongside OpenAI. What an honor!...

Kubernetes API limitations in finding non-standard pods and containers

Gain a deeper understanding of why it's essential to monitor non-standard pods and containers, including static pods, mirror pods, init containers, pause containers, and ephemeral containers within your Kubernetes environment...

Wiz and Google Cloud’s Security Command Center: Modern threat detection and response rooted in risk prioritization

Fully understand the impact and architecture behind any threat to streamline and speed effective response with a first-of-its-kind integration combining the Wiz Security Graph’s deep cloud and multi-cloud risk context with Google Cloud’s Security Command Center’s advanced threat detection...

Inside the Metabase SQLi: Exploited in the Wild

Reverse engineering Metabase CVE-2026-72898 with AI to accelerate defense...

keyv and cacheable npm Package Hijacked in Supply Chain Attack

Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages...

How ProdSec uses Wiz

Automation, resilience, and security for the modern age...

Beyond Findings: Connecting Exploitable Risk to Cloud Context with Wiz and HackerOne

See proven, exploitable risk in the context of your full cloud environment...

MongoBleed (CVE-2025-14847) exploited in the wild: everything you need to know

Detect and mitigate CVE-2025-14847, an unauthenticated information leak vulnerability in MongoDB. Exploitation has been observed in the wild. Organizations should patch urgently...

It's Here! Wiz Exposure Management is Now GA

Moving beyond CVE counts to true exposure management everywhere with new UVM and ASM capabilities, now GA...

WizOS Is Here: Transforming Container Security from the Image Up

WizOS is in public preview starting today, enabling Wiz customers to adopt and operationalize secured images at scale...

Introducing Wiz Service Catalog: Democratize Cloud Security with Application Service Visibility

Empower platform teams and developers to reduce noise, scale ownership, and accelerate remediation across cloud-native apps...

GitHub Action tj-actions/changed-files supply chain attack: everything you need to know

A supply chain attack on popular GitHub Action tj-actions/changed-files caused many repositories to leak their secrets. Discover how it unfolded and the steps to mitigate the risk...

Key Takeaways from the 2025 State of AI in the Cloud Report

From DeepSeek adoption to impact on security and governance...

Cloud Detection Without Drowning: The Zero-Noise Approach

By adopting the 'Zero Noise' approach—prioritizing attacker-focused detections, continuous feedback loops, and a 'no alert left behind' mentality—security teams can cut through cloud alert noise, enabling swift and precise responses to true threats...

Avoiding mistakes with AWS OIDC integration conditions

Let’s explore some common missteps in securing your AWS OIDC...

AskAI – Text to Security Graph Query

AskAI – Text to Security Graph Query...

Shifting from CWPP to CNAPP: new standards for cloud security

Learn where CNAPP and CWPP overlap, where they differ, and how the market is shifting to the more comprehensive and integrated CNAPP...

The magic of inclusion: Wiz’s journey to democratize cloud security

Empowering every cloud security stakeholder by eliminating barriers...

Finding the needle in the haystack: effortless SBOM search in your cloud with Wiz

Find out quickly where OS and open-source packages or libraries are deployed in your cloud environments and secure them before potential issues arise...

Defense in depth: XZ Utils

We explore assessment, prevention, and detection strategies for protecting your organization from the XZ Utils vulnerability...

Midnight Blizzard attack on Microsoft corporate environment: a detailed analysis, detections and recommendations

Get a detailed analysis of the entire attack chain of Microsoft's breach by Midnight Blizzard APT29, as well as detection and mitigation recommendations...

Introducing the Cloud Threat Landscape, a new TI resource for cloud defenders

The Cloud Threat Landscape is a threat intelligence database that summarizes cloud incidents and offers insights into targeting patterns and initial access methods...

Wiz recognized as a leader in Snowflake's inaugural cybersecurity report

Powered by Snowflake, Wiz delivers a Cloud Native Application Protection Platform CNAPP to joint customers...

Wiz launches data center in Mumbai, supporting the growing operations of global organizations in India

Wiz is proud to announce the opening of its data center in Mumbai, India...

Fortify your cloud security with Wiz as it integrates with Microsoft Sentinel

Lock down your cloud infrastructure with the new Wiz integration with Microsoft Sentinel. Gain full context, support thorough investigations, and automate your response for ultimate security...

Wiz helps organizations innovate with AI securely and responsibly, launching support for Google Cloud Vertex AI

Wiz protects AI infrastructure against cloud attacks, allowing data scientists and engineers to focus on deploying more AI applications...

Breaking new ground in the cloud

In just two years, Wiz helps hundreds of customers protect their cloud infrastructure and innovate more quickly. As a result, Wiz has become the fastest-growing software company ever, scaling from $1M ARR to $100M ARR in just 18 months...

NotLegit: Azure App Service vulnerability exposed hundreds of source code repositories

Read about the NotLegit vulnerability discovered by the Wiz Research Team, where the Azure App Service exposed hundreds of source code repositories...