Intelligence Feed

1d ago · wiz

Attackers are abusing Entra ID device registration functionality to establish persistent access by registering rogue devices using stolen credentials, often obtained via device code phishing. Traditionally, these attacks used predictable indicators like 'DESKTOP-XXXXXXXX' device names and specific User-Agent strings, but attackers are now adopting AI-generated, benign-looking identifiers such as 'Work PC' to evade static detection. The article highlights a shift toward behavioral detection methods, including identifying anomalies in device naming conventions and correlating device code phishing with subsequent device registration events to detect these stealthier attacks.

1d ago · wiz

Wiz Threat Research observed 90 days of sustained attacks against AI infrastructure through honeypots deployed across services like LiteLLM, Flowise, and LangChain. Attackers exploited vulnerabilities in MCP servers, including authentication bypass and command injection (CVE-2026-59822, CVE-2026-42271), to achieve remote code execution and deploy cryptominers. A second pattern involved blind prompt injection against AI agent frameworks, where attackers used out-of-band DNS callbacks to confirm execution and later fetch payloads from Pastebin. Post-exploitation activity was tailored to AI environments, including in-memory extraction of LiteLLM master keys, model enumeration, and use of environment-specific camouflage to hide malicious binaries.

1d ago · wiz

A supply chain attack was conducted against the Rust ecosystem by compromising the maintainer account of widely used crates, including arrayref, internment, and append-only-vec. Malicious versions were published with a typosquatted dependency, proc-macro1, which executes a build script to download and run a second-stage payload. The payload acts as a backdoor, exfiltrating system information, enumerating browser login data, and enabling remote command execution, with infrastructure and TTPs showing significant overlap with DPRK-linked campaigns such as Mastra and UNC1069.

2w ago · wiz

Wiz Research's AI-powered Red Agent discovered a critical script injection vulnerability in a GitHub Actions workflow within Snowflake's public repository snowflakedb/snowflake-connector-net. The vulnerability was introduced on June 18, 2026, via an AI-generated 'autofix' commit that removed safe input handling, allowing unauthenticated users to execute arbitrary commands by opening a maliciously titled GitHub issue. Wiz successfully exploited the flaw to exfiltrate Snowflake's Jira API token, which granted read access to internal engineering and security projects. Snowflake patched the workflow, rotated credentials, and confirmed no unauthorized access occurred beyond Wiz's testing.

3w ago · wiz

A zero-day SQL injection vulnerability in Metabase, tracked as GHSA-vwf4-m7j8-wcjf, has been exploited in the wild against Metabase Cloud and potentially self-hosted instances. The vulnerability exists in versions 1.58 and later, where an attacker can inject malicious SQL by including a 'user-id' parameter with a 'raw' SQL payload in the /api/session/reset_password endpoint. The flaw stems from improper handling of JSON input, merging of unvalidated user input, and unsafe use of HoneySQL's :raw directive, leading to arbitrary blind SQL injection. Wiz Research reverse-engineered the vulnerability after the patch was not publicly disclosed, and observed public proof-of-concept exploits as of August 10, 2026.

3w ago · wiz

In H1 2026, a surge in cloud-based threats was driven by aggressive software supply-chain attacks, particularly by the group TeamPCP, which compromised developer toolchains across npm, PyPI, and VSCode extensions to steal credentials and propagate across cloud environments. TeamPCP's malware evolved to exploit CI misconfigurations, extract OIDC tokens, and deploy wipers with Dune-themed taunts. North Korea's UNC1069 conducted parallel campaigns, trojanizing the axios package and compromising over 140 @mastra-related packages. The open-sourced Shai-Hulud worm enabled follow-on attacks like IronWorm, which used Rust-based binaries and eBPF rootkits for stealth. A new extortion group, JINX-0163, emerged, targeting cloud identities across AWS, Azure, and GCP to steal secrets and enable ransom threats via the alias 'FulcrumSec'.

4w ago · wiz

Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API that allowed attackers to achieve arbitrary code execution on the database gateway and access the 'Cosmos Master Key'—a platform-wide secret enabling full read and write access to any Cosmos DB account. This vulnerability could have been exploited to enumerate and compromise every database in the service, including Microsoft's internal databases used by services like Microsoft Entra ID, Teams, and Copilot. The attack chain also allowed bypassing network isolation controls, potentially affecting private and network-locked databases. Microsoft has since remediated the issue, deployed mitigations, and rolled out long-term architectural fixes.

1mo ago · wiz

Wiz Research identified widespread exposure of unauthenticated Model Context Protocol (MCP) servers across cloud environments, including systems belonging to Fortune 500 companies. These exposed servers can leak sensitive data, enable unauthorized write and delete operations, and in some cases allow code execution or access to cloud credentials. The majority still use the original 2024-11-05 protocol version without authentication, making them easy targets for reconnaissance and exploitation. Attackers can leverage the self-describing nature of MCP to automatically discover and abuse capabilities without needing prior knowledge of the API.

1mo ago · wiz

The article discusses CISA's Binding Operational Directive (BOD) 26-04, which mandates U.S. federal agencies to prioritize vulnerability remediation based on real-world risk signals rather than static CVSS scores. It emphasizes the need for rapid response timelines, forensic triage for high-risk vulnerabilities, and integration of threat intelligence with internal cloud context. Wiz's platform is presented as a solution to automate risk categorization, exposure validation, and triage workflows to meet compliance requirements in an AI-accelerated threat landscape.

1mo ago · wiz

Wiz Research developed Atlas, an autonomous AI system for vulnerability research, which has discovered over 200 previously unknown vulnerabilities in heavily audited open-source projects such as Kubernetes, Linux kernel, and gVisor. The system uses a multi-agent, adversarial validation approach to identify and confirm vulnerabilities with reproducible proof, minimizing false positives. One notable finding was a critical RCE vulnerability in GitHub (CVE-2026-3854), which led to the largest bug bounty payout in GitHub's history.

1mo ago · wiz

Wiz Research developed Atlas, an autonomous AI system for vulnerability research, which has discovered over 200 previously unknown vulnerabilities in heavily audited open-source projects such as grpc, dnsmasq, Kubernetes, and the Linux kernel. Atlas ranks #1 on CyberGym with a 90.9% success rate and uses a multi-agent, adversarial validation system to minimize false positives. Each finding is end-to-end validated with a working exploit, including the discovery of a critical RCE vulnerability in GitHub (CVE-2026-3854), which led to the largest bug bounty payout in GitHub's history.

1mo ago · wiz

Wiz Research discovered a series of critical unauthenticated Remote Code Execution (RCE) vulnerabilities in Ingress NGINX Controller for Kubernetes, collectively dubbed IngressNightmare. These vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974) allow attackers to inject malicious NGINX configurations and achieve remote code execution on the ingress controller pod, leading to full cluster compromise. The admission controller, which is exposed without authentication by default, enables exploitation by processing untrusted admission review requests. Over 43% of cloud environments are estimated to be vulnerable, with more than 6,500 clusters already exposed to the public internet.

1mo ago · wiz

FortiGate virtual appliances are being actively targeted by multiple threat actors due to their internet-facing nature and elevated privileges. Attackers exploit vulnerabilities such as CVE-2026-24858, CVE-2024-55591, and CVE-2022-41328 to gain access, create backdoor accounts, manipulate certificates, and establish lateral movement. These activities are often obscured by log deletion and weak configurations, making detection difficult without agentless visibility.

1mo ago · wiz

Wiz Research has identified active exploitation of a critical pre-authentication remote code execution vulnerability chain in WordPress Core, referred to as 'wp2shell'. The vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137, are being exploited in the wild to deploy persistent webshells on unpatched servers. Organizations are urged to prioritize patching or implement WAF-based mitigations to prevent compromise.

1mo ago · wiz

Wiz's agentless visibility capabilities have uncovered extensive threat activity across cloud environments, including exploitation of zero-day vulnerabilities in FortiGate and PAN-OS devices, credential stuffing campaigns, and supply chain attacks via malicious npm packages. Attackers are leveraging misconfigurations in Redis and MongoDB to achieve remote code execution and data exfiltration. Webshells are being deployed on WordPress instances via the wp2shell vulnerability, enabling persistent access and command execution. These findings highlight the risk posed by unmonitored virtual appliances and exposed services in cloud infrastructures.

1mo ago · wiz

A critical pre-authentication remote code execution (RCE) vulnerability chain in WordPress Core, dubbed 'wp2shell' and tracked as CVE-2026-63030 and CVE-2026-60137, is being actively exploited in the wild. The vulnerabilities allow unauthenticated attackers to execute arbitrary code on vulnerable WordPress instances, leading to webshell deployment, user enumeration, and admin panel access. Multiple threat actors have been observed exploiting these flaws, deploying both simple and sophisticated PHP webshells, while mass scanning campaigns suggest widespread opportunistic targeting.

1mo ago · wiz

In July 2026, an attacker exploited a misconfigured GitHub Actions workflow in the AsyncAPI generator repository using a 'pwn request' technique to steal a privileged Personal Access Token. The attacker published five malicious npm packages under the @asyncapi namespace, which download and execute a multi-stage payload establishing persistence and connecting to C2 infrastructure. The payload targets developer credentials, including browser data, SSH keys, and cloud tokens, and communicates via HTTP, Nostr relays, Ethereum smart contracts, and IPFS. The attack leverages infrastructure and obfuscation techniques linked to the Miasma framework but shows distinct characteristics from prior campaigns.

1mo ago · wiz

A business-logic flaw in a B2B platform's data API allowed unauthorized access to premium contact data without spending credits. The vulnerability stemmed from the backend trusting a client-controlled boolean flag 'unmaskContactData' without validating user entitlements. This enabled free-tier users to bypass paywall restrictions and extract unmasked business emails, phone numbers, and personal information at scale. The flaw highlights a critical gap in server-side authorization enforcement, which traditional security tools failed to detect.

1mo ago · wiz

The article discusses the importance of Infrastructure-as-Code (IaC) coverage as a security metric for cloud environments. It emphasizes that IaC coverage enables traceability, resilience, and compliance by ensuring cloud resources are defined and governed in code. The article introduces a funnel model—supportable, tracked, and mapped—to measure how well cloud infrastructure is governed through IaC, highlighting that higher coverage enables machine-speed remediation and better security posture.

1mo ago · wiz

The 2026 Verizon DBIR highlights that attackers are exploiting known vulnerabilities and trusted relationships at increasing speed and scale, with vulnerability exploitation now the leading initial access vector in 31% of breaches. Cloud environments are particularly at risk, as 40% of cloud intrusions begin with weaponized vulnerabilities. Attackers are leveraging AI to accelerate reconnaissance, exploit development, and post-compromise automation, while supply chain compromises and identity abuse further expand the attack surface.

1mo ago · wiz

The article describes how Wiz's Product Security (ProdSec) team leverages the Wiz platform to secure cloud environments through integrated threat detection, CI/CD security controls, and proactive threat modeling. The team employs Wiz CLI scanning, custom Cloud Configuration Rules (CCRs), and automated threat detection using the Wiz Blue Agent to identify and respond to risks in real time. Emphasis is placed on shifting security left into development workflows, contextualizing alerts for specialized infrastructure, and pressure-testing security tooling using AI-powered attack simulations like Red Agent.

1mo ago · wiz

The article discusses the expanding attack surface in modern cloud and AI-driven environments, emphasizing the challenges posed by shadow IT and unknown risks such as logic flaws and exposed assets. Wiz introduces automated reconnaissance capabilities in its Attack Surface Management (ASM) platform to continuously discover subdomains and shadow assets across any environment. The solution combines external reconnaissance with internal context to identify exploitable risks, including misconfigurations, leaked secrets, and logic-based vulnerabilities, enabling organizations to defend against AI-powered threats.

1mo ago · wiz

GhostApproval is a trust boundary vulnerability affecting multiple AI coding assistants, where malicious repositories use symbolic links to trick agents into accessing or modifying files outside the intended workspace sandbox. The attack exploits symlink following (CWE-61) and UI misrepresentation (CWE-451), allowing adversaries to silently write to sensitive system files such as ~/.ssh/authorized_keys or ~/.zshrc. Despite confirmation prompts, users are often misled about the actual file being modified, leading to potential remote code execution and persistent access. Vendors including AWS, Cursor, and Google have issued fixes, while others have acknowledged or rejected the issue.

1mo ago · wiz

The article discusses the evolving threat landscape in the AI era, emphasizing the need for real-time detection and containment of threats that leverage AI-driven techniques such as prompt injection, supply chain abuse, and exploitation of cloud-native AI services. Traditional detection methods are insufficient due to limited visibility, high false positive rates, and slow manual response times. Wiz addresses these challenges by providing comprehensive telemetry across cloud, workload, identity, and AI model layers, enabling automated investigation with the Blue Agent and rapid containment via orchestrated workflows.

1mo ago · wiz

AI is transforming both offensive and defensive cybersecurity operations by accelerating software development and exploit creation. Attackers are leveraging AI to shorten exploitation timelines, challenging the traditional assumption that defenders have time to respond. Defenders can gain an advantage by using AI to maintain continuous, context-rich understanding of their environments across cloud, workload, and model layers, enabling faster and more accurate incident response.

1mo ago · wiz

Wiz introduces runtime signals in its Security Graph to uncover hidden attack paths in cloud environments by correlating live network connections with existing risk findings. This new capability reveals previously invisible threats, such as internet-facing AI chatbots with vulnerabilities that actively connect to external MCP servers or sensitive data stores. By integrating real-time telemetry from workloads, Wiz identifies complete, validated attack paths—like a vulnerable container with a live connection to an S3 bucket containing PII—enabling security teams to prioritize and remediate critical risks before exploitation.

1mo ago · wiz

Wiz Research discovered a high-severity vulnerability (CVE-2026-12957) in the Amazon Q Developer Extension for VS Code that allowed arbitrary code execution and cloud credential theft when a developer opened a malicious repository. The vulnerability stemmed from the extension automatically loading and executing MCP server configurations from workspace files without user consent. Combined with full environment inheritance, this enabled immediate execution of malicious commands with access to cloud credentials, posing a significant risk to developers and cloud environments.

1mo ago · wiz

The Red Agent, an autonomous AI-powered security testing tool, discovered a critical Broken Object-Level Authorization (BOLA) vulnerability in an airline's public GraphQL booking API. By exploiting sequential integer identifiers without backend authorization checks, the agent gained unauthenticated access to sensitive passenger data, including personal information, contact details, billing addresses, and active flight itineraries. The vulnerability allowed full read and write capabilities, enabling data exfiltration and unauthorized modifications to bookings, demonstrating a systemic authorization flaw in the API's resolver layer.

1mo ago · wiz

The article discusses the growing complexity of securing hybrid cloud environments within the U.S. public sector, where interconnected systems expand the attack surface. It highlights how traditional, siloed security tools fail to provide context-aware risk assessment, leading to inefficient remediation. Wiz Exposure Management (Wiz XM) is presented as a solution that unifies on-premises and cloud telemetry to prioritize real, exploitable risks by correlating vulnerabilities with network exposure and mission impact.

1mo ago · wiz

The article discusses Wiz's expansion of its security platform to support hybrid cloud environments, introducing the Sensor Workload Scanner (WLS) for on-premise infrastructure. It emphasizes unified risk visibility across cloud and on-premise systems, enabling security teams to detect attack paths such as exposed credentials and vulnerable workloads. The solution integrates runtime threat detection, attack surface management, and automated remediation to prioritize real, exploitable risks over isolated vulnerabilities.