706 matches found
Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)
Details on CVE-2026-3854: A critical flaw in GitHub’s internal git infrastructure enabling RCE on GitHub.com and GitHub Enterprise Server...
KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack
Checkmarx KICS scanner is the latest victim of a credential-stealing supply chain attack by TeamPCP. Between 12:58–16:50 UTC on March 23, 35 tags were hijacked. Learn how to audit your workflows, identify malicious activity, and secure your GitHub Actions...
Twenty Years of Cloud Security Research
This post will look at the past 20 years of cloud security research, separating the two decades into eras with important milestones defined that resulted in the change of one era to the next...
Gogs 0-Day Exploited in the Wild
Wiz Threat Research has observed exploitation in-the-wild of CVE-2025-8110...
Introducing Wiz Incident Response: Your Expert Partner for Cloud Security Incidents
Announcing the public preview of Wiz’s in-house Incident Response service—empowering customers to investigate, contain, and resolve cyber incidents with confidence...
Ultralytics AI Library Hacked via GitHub for Cryptomining
A supply chain attack on Ultralytics exploited GitHub Actions to inject malicious PyPI packages. Discover how it unfolded and the steps to mitigate the risk...
What does "Platform" mean in cloud security?
Enabling security outcomes for cloud builders and defenders, from code to cloud to defense...
Sailing Securely Across the SDLC: Introducing Wiz's Image Trust and Kubernetes Audit Log Collector
Secure your applications across the SDLC by deploying only trusted images and monitoring your Kubernetes control plane in near-real time to detect potential threats...
Proof of storage crypto miners
We explore “proof-of-storage" cryptocurrencies like Chia, the potential for proof-of-storage cryptojacking attacks, and steps defenders can take to detect them...
New EKS Access Management and Pod Identity features: a security analysis
The Wiz research team unpacks the security implications of the new EKS access and identity management features and recommends best practices when using them...
Choosing an AI-SPM tool: The four questions every security organization needs to ask
Ensure you are staying secure as your organization adopts AI by following these four guiding questions...
Wiz launches support for Google Cloud excessive access findings based on audit logs
Google Cloud customers can now detect excessive access in their GCP environment based on Google audit logs to effectively right-size permissions...
How to get rid of AWS access keys – Part 3: Replacing the authentication
In the earlier posts in this series, we showed not only how to get rid of unused access keys, but also how to minimize risk by applying a least-privilege strategy. In this final post, we’ll at last get into the discussion of alternative solutions to using access keys...
Crying Out Cloud: a magical podcast for cloud security enthusiasts
Join us for game-changing news, unique Wiz insights, and battle-tested advice from industry experts. Stay ahead of the cloud curve with our latest episodes and navigate the complex world of cloud security...
Here's what security teams need to know about the new Biden-Harris National Cybersecurity Strategy
The release of the National Cybersecurity Strategy by the Biden-Harris Administration is a significant development that will have an impact on security teams across the United States. What does it say?...
Wiz launches Australia cloud data center further demonstrating commitment to ANZ and multinational organizations
Wiz announces availability of new regional data center and adds support for Essential Eight controls...
Securing AWS Lambda function URLs
Learn about the security risks of misconfigured Lambda function URLs and how to properly secure them...
The Wiz Red Agent is Now Generally Available
Continuously uncover complex, exploitable risks to stay ahead in the AI Threat Era with the Red Agent...
A Framework for AI Threat Readiness
AI models now find and exploit zero-days autonomously. This 4-pillar framework accelerates patching, analysis, and threat response...
Agentic Browser Security: 2025 Year-End Review
Are agentic browsers the new Flash? A 2025 review of new attacks, vendor security layers, and a roadmap for navigating AI browser risks...
Snipping the Long Tail of Shai-Hulud 2.0
Wiz Research reveals the data behind Shai-Hulud's 2.0 long tail, the massive gap in cloud credential rotation, a potential link to the Trust Wallet incident, and how we finally "snipped the tail" on a month of ongoing infections...
How CISOs Should Plan Security Budgets for 2026
Build a defensible 2026 security budget with data, not guesswork. We share practical tips, ROI levers, and fresh insights from our survey of 300+ CISOs and security leaders...
Wiz Completes IRAP Assessment to Support Australian Government Cloud Security
Empowering Australian government agencies with enhanced cloud security...
Deloitte’s Secure by Design (SbD) Approach – Enhanced with Wiz
How Deloitte and Wiz Enable End-to-End Security Without Slowing Down Development...
What Analyzing Hundreds of Thousands of Cloud Environments Taught Us About Data Exposure
Wiz Research reveals the latest cloud data security trends across hundreds of thousands of real-world environments...
Wiz Expands Runtime Protection to Serverless Containers
Wiz extends its cloud-native runtime sensor to secure serverless containers, providing deep visibility, blocking, and hunting capabilities for AWS Fargate and Azure Container Apps...
GenAI risks to be aware of — and prepare for — according to Gartner®
The deployment of GenAI, LLMs, and chat interfaces expands potential attack surfaces and poses increased security threats...
Pause off my cluster: DERO cryptojacking takes a new shape
Learn how the threat actors behind the 2023 DERO cryptojacking campaign have adapted their techniques to evade detection, and the best practices for mitigation...
Operationalizing cloud security with Wiz and Tines
The Wiz and Tines partnership combines the benefits of visibility and automation, creating an improved cloud security strategy...
How to leverage AI-powered security in your organization
AI-powered security helps organizations improve efficiency and scale their security team, follow this framework to effectively leverage AI in your security org...
Biden's AI Executive Order: What it says, and what it means for security teams
The 2023 Executive Order has far-reaching implications for companies relying on AI. Here is a breakdown of it through the lens of a Security Engineer, including an analysis, a summary of the impact on AI safety and privacy protection, and a look at how the order will affect security teams...
Inside the vault: how financial institutions protect their cloud environments
As part of our monthly CISO webinar series, Wiz’s VP of Product Strategy, Raaz Herzberg, spoke with three security experts to learn how each of them prioritize cloud security, and how they extend the reach of good security practices across their organizations...
PyLoose: Python-based fileless malware targets cloud workloads to deliver cryptominer
PyLoose is a newly discovered Python-based fileless malware targeting cloud workloads. Get a breakdown of how the attack unfolds and the steps to mitigate it...
Kubernetes Grey Zone: Risks in Managed Cluster Middleware
Are your managed Kubernetes clusters safe from the risks posed by middleware components? Learn how to secure your clusters and mitigate middleware risks...
Wiz Receives 2023 Global Cloud Security Entrepreneurial Company of the Year Award
Frost & Sullivan applauds Wiz for its innovation and impact in the cloud security industry...
BingBang: How a simple developer mistake could have led to Bing.com takeover
How a misconfiguration in a Microsoft Bing.com application allowed Wiz Research to modify Bing’s search results – and potentially compromise the private data of millions of Bing users...
Wiz and SentinelOne announce exclusive partnership to deliver end to end cloud security
Leading cybersecurity companies partner to increase customer value and disrupt the enterprise security industry...
Meet new Wiz board member Emily Heath
Q&A: Why Wiz caught the attention of DocuSign’s Former CTSO...
Wiz extends CNAPP leadership with protection for Alibaba Cloud
Support for Alibaba Cloud follows just weeks after launch of Oracle Cloud Infrastructure OCI integration, providing organizations the broadest coverage of any cloud native application protection platform CNAPP...
Wiz now integrates with Oracle Cloud Infrastructure, bringing a graph-based cloud security approach to all major providers
Fortune 500’s Avery Dennison among enterprises that operate securely on OCI and other cloud infrastructure with Wiz...
Detect and prioritize CISA Known Exploited Vulnerabilities in the cloud with Wiz
For each CVE, the Wiz Research team maintains data from multiple threat intelligence sources and our own independent research. Now that we’ve added support for the new CISA KEV catalog, learn how you can use it in your cloud environment...
What’s New in Wiz Service Catalog: Smarter Discovery, Governance, and Service-Level Context
Build your Service Catalog faster, keep service context current, and give teams a clearer path from cloud risk to accountability...
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329. Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control...
Wiz on Wiz: How the Wiz FinOps Team Uses Wiz Cloud Cost
Powering cost investigation and optimization with deep cloud context...
Exploitation in the Wild of wp2shell
Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core CVE-2026-63030 & CVE-2026-60137. Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations...
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Multi-ecosystem supply chain compromise by TeamPCP targets GitHub, NPM, and VSCode to steal credentials and establish persistence...
Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild
Detect and mitigate CVE-2026-0300, a critical vulnerability in Palo Alto Networks PAN-OS User-ID Authentication Portal that allows unauthenticated attackers to achieve remote code execution RCE with root privileges...
NIST NVD Update: What it Means For Vulnerability Management
The shift from static CVE scoring to risk-based prioritization signals a new era for Vulnerability Managers...