Intelligence Feed

53m ago · wiz

A critical out-of-bounds write vulnerability, CVE-2026-111497 (Broccoli2Shell), has been identified in the Brotli decompression library, affecting multiple widely used technologies including Node.js, Bun, Envoy Proxy, and Python packages. The flaw allows unauthenticated remote attackers to trigger memory corruption, disclose sensitive information, crash processes, or potentially achieve remote code execution by supplying maliciously crafted Brotli-compressed data. Cloud environments are especially at risk, with Wiz reporting that 91% of cloud environments have vulnerable resources and 82% have publicly exposed Node.js instances, highlighting widespread exposure across containerized applications, Kubernetes clusters, and serverless workloads.

54m ago · wiz

The article details ongoing exploitation attempts against the recently disclosed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Wiz Research observed multiple attack variants using different exploit kits, primarily targeting memory exhaustion and session poisoning, though no complete end-to-end exploitation was confirmed in their telemetry. Attackers used techniques such as sending oversized multipart requests to trigger memory exhaustion and attempted to leak process memory, but these stages failed due to differences in PHP configurations and deployment environments. The report also notes that some IP addresses successfully exploited honeypots, contributing to CISA's inclusion of PHP2Shell in its KEV catalog, while other tools labeled as PHP2Shell exploits actually relied on unrelated session poisoning and LFI techniques.

56m ago · wiz

A coordinated campaign dubbed 'Black October' targeted multiple AI developer platforms in October, resulting in at least nine disclosed security incidents. The attacks exploited credentials through various initial access vectors, including supply chain compromises, privilege escalation, and third-party dependencies. Threat actors focused on stealing AI model access keys to enable LLMJacking—monetizing stolen tokens via resale platforms. Wiz observed downstream abuse of compromised enterprise credentials, with attackers validating keys, probing model availability, and launching massive inference floods across services like AWS Bedrock, generating over $100k in estimated usage. Two resale hubs, linked to IPs 23.106.46.239 and 38.246.114.118, were identified as key players in the illicit LLM token economy.

1w ago · wiz

Threat actors are conducting phishing campaigns via malicious Google Search ads to steal Google Cloud Platform (GCP) credentials and multi-factor authentication codes. Using compromised accounts, attackers gain access to GCP environments, disable organizational policy controls, and link external attacker-controlled projects to the victim's billing accounts. This allows them to abuse the victim's financial resources for large-scale, unauthorized Large Language Model (LLM) inference through Google's Gemini API, resulting in massive, undetected API charges. The attackers also employ geographic blending and demote legitimate administrators to evade detection and maintain persistence.

1w ago · wiz

Wiz CIRT investigated a real-world AI-driven cloud attack where an autonomous AI agent conducted end-to-end intrusion operations, including initial access, credential harvesting, lateral movement, and data exfiltration across multi-cloud environments. The attacker used machine-speed automation, simultaneous cross-platform operations, and self-debugging capabilities to rapidly pivot through cloud, Kubernetes, CI/CD, and identity systems. The attack leveraged a Java RCE vulnerability in an exposed Kafka UI for initial access and used AI-generated scripts with descriptive comments and task identifiers like 'pentest', 'recon', and numeric IDs to maintain persistence and exfiltrate data.

1w ago · wiz

The article describes a real-world supply chain attack involving the compromise of npm packages in the keyv/cacheable ecosystem, where a malicious actor exploited a GitHub maintainer account to publish backdoored versions. The malware dynamically retrieved command-and-control (C2) domains at runtime by querying an Ethereum smart contract, evading static analysis. Wiz's detection pipeline identified the malicious behavior through dynamic analysis and runtime monitoring, detecting connections to a suspicious domain before a CVE was published. This allowed proactive alerting and blocking within customer environments via automated threat intelligence distribution.

1w ago · wiz

Wiz Research discovered critical remote code execution (RCE) and memory disclosure vulnerabilities in PHP's core engine, collectively dubbed 'PHP2Shell', affecting nearly all PHP versions released in the last decade, including PHP 5.4 and later. The vulnerabilities stem from memory-safety issues related to how PHP handles fatal errors during request processing, enabling unauthenticated attackers to achieve remote code execution or read sensitive process memory containing passwords, tokens, and API keys. Exploitation is application-agnostic and affects any PHP-based application, including WordPress, Drupal, and Joomla, even with secure application code. The vulnerabilities were responsibly disclosed and patched on October 21, 2026, with AI models playing a key role in both discovery and exploit development.

2w ago · wiz

The article discusses the evolving threat landscape due to AI-accelerated development and exploitation, highlighting the importance of Application Security Posture Management (ASPM) to manage increased risk velocity. It references a specific critical vulnerability, CVE-2025-55182 (React2Shell), which enables remote code execution in Next.js applications, leading to widespread exposure across micro-frontends and containerized workloads. The vulnerability results in thousands of findings across repositories and container images, necessitating contextual prioritization to identify exploitable instances. Wiz Code is presented as a solution to correlate scanner findings with cloud exposure and runtime context to prioritize remediation.

1mo ago · wiz

Wiz Research has identified active in-the-wild exploitation of three vulnerabilities in JFrog Artifactory: CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Attackers are chaining CVE-2026-42018 and CVE-2026-42016 to escalate privileges from an unauthenticated state to admin access, while CVE-2026-82329 allows direct unauthenticated administrative access. Post-exploitation activities include creation of persistent admin accounts, deployment of malicious Groovy plugins, execution of ad-hoc commands, and installation of Rust-based backdoors for C2 communication. Multiple threat actors have been observed exploiting these flaws across self-hosted Artifactory instances, with evidence of configuration exfiltration, credential theft, and persistence mechanisms.

1mo ago · wiz

Multiple critical vulnerabilities were discovered in LiteLLM, a popular open-source LLM gateway, enabling authentication bypass, remote code execution, and cloud credential theft. CVE-2026-59822 allows unauthenticated access to MCP endpoints via a Bearer token bypass, while CVE-2026-59821 enables post-authentication root-level RCE through unsandboxed custom code guardrails. A default master key (sk-1234) is accepted by 9.6% of public instances, allowing attackers to achieve admin access and exploit these vulnerabilities. Additionally, pass-through endpoints can be abused to exfiltrate cloud metadata and IAM credentials, especially when combined with default or missing authentication.

2mo ago · wiz

Attackers are abusing Entra ID device registration functionality to establish persistent access by registering rogue devices using stolen credentials, often obtained via device code phishing. Traditionally, these attacks used predictable indicators like 'DESKTOP-XXXXXXXX' device names and specific User-Agent strings, but attackers are now adopting AI-generated, benign-looking identifiers such as 'Work PC' to evade static detection. The article highlights a shift toward behavioral detection methods, including identifying anomalies in device naming conventions and correlating device code phishing with subsequent device registration events to detect these stealthier attacks.

2mo ago · wiz

Wiz Threat Research observed 90 days of sustained attacks against AI infrastructure through honeypots deployed across services like LiteLLM, Flowise, and LangChain. Attackers exploited vulnerabilities in MCP servers, including authentication bypass and command injection (CVE-2026-59822, CVE-2026-42271), to achieve remote code execution and deploy cryptominers. A second pattern involved blind prompt injection against AI agent frameworks, where attackers used out-of-band DNS callbacks to confirm execution and later fetch payloads from Pastebin. Post-exploitation activity was tailored to AI environments, including in-memory extraction of LiteLLM master keys, model enumeration, and use of environment-specific camouflage to hide malicious binaries.

2mo ago · wiz

A supply chain attack was conducted against the Rust ecosystem by compromising the maintainer account of widely used crates, including arrayref, internment, and append-only-vec. Malicious versions were published with a typosquatted dependency, proc-macro1, which executes a build script to download and run a second-stage payload. The payload acts as a backdoor, exfiltrating system information, enumerating browser login data, and enabling remote command execution, with infrastructure and TTPs showing significant overlap with DPRK-linked campaigns such as Mastra and UNC1069.

2mo ago · wiz

Wiz Research's AI-powered Red Agent discovered a critical script injection vulnerability in a GitHub Actions workflow within Snowflake's public repository snowflakedb/snowflake-connector-net. The vulnerability was introduced on June 18, 2026, via an AI-generated 'autofix' commit that removed safe input handling, allowing unauthenticated users to execute arbitrary commands by opening a maliciously titled GitHub issue. Wiz successfully exploited the flaw to exfiltrate Snowflake's Jira API token, which granted read access to internal engineering and security projects. Snowflake patched the workflow, rotated credentials, and confirmed no unauthorized access occurred beyond Wiz's testing.

2mo ago · wiz

A zero-day SQL injection vulnerability in Metabase, tracked as GHSA-vwf4-m7j8-wcjf, has been exploited in the wild against Metabase Cloud and potentially self-hosted instances. The vulnerability exists in versions 1.58 and later, where an attacker can inject malicious SQL by including a 'user-id' parameter with a 'raw' SQL payload in the /api/session/reset_password endpoint. The flaw stems from improper handling of JSON input, merging of unvalidated user input, and unsafe use of HoneySQL's :raw directive, leading to arbitrary blind SQL injection. Wiz Research reverse-engineered the vulnerability after the patch was not publicly disclosed, and observed public proof-of-concept exploits as of August 10, 2026.

2mo ago · wiz

In H1 2026, a surge in cloud-based threats was driven by aggressive software supply-chain attacks, particularly by the group TeamPCP, which compromised developer toolchains across npm, PyPI, and VSCode extensions to steal credentials and propagate across cloud environments. TeamPCP's malware evolved to exploit CI misconfigurations, extract OIDC tokens, and deploy wipers with Dune-themed taunts. North Korea's UNC1069 conducted parallel campaigns, trojanizing the axios package and compromising over 140 @mastra-related packages. The open-sourced Shai-Hulud worm enabled follow-on attacks like IronWorm, which used Rust-based binaries and eBPF rootkits for stealth. A new extortion group, JINX-0163, emerged, targeting cloud identities across AWS, Azure, and GCP to steal secrets and enable ransom threats via the alias 'FulcrumSec'.

3mo ago · wiz

Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API that allowed attackers to achieve arbitrary code execution on the database gateway and access the 'Cosmos Master Key'—a platform-wide secret enabling full read and write access to any Cosmos DB account. This vulnerability could have been exploited to enumerate and compromise every database in the service, including Microsoft's internal databases used by services like Microsoft Entra ID, Teams, and Copilot. The attack chain also allowed bypassing network isolation controls, potentially affecting private and network-locked databases. Microsoft has since remediated the issue, deployed mitigations, and rolled out long-term architectural fixes.

3mo ago · wiz

Wiz Research identified widespread exposure of unauthenticated Model Context Protocol (MCP) servers across cloud environments, including systems belonging to Fortune 500 companies. These exposed servers can leak sensitive data, enable unauthorized write and delete operations, and in some cases allow code execution or access to cloud credentials. The majority still use the original 2024-11-05 protocol version without authentication, making them easy targets for reconnaissance and exploitation. Attackers can leverage the self-describing nature of MCP to automatically discover and abuse capabilities without needing prior knowledge of the API.

3mo ago · wiz

The article discusses CISA's Binding Operational Directive (BOD) 26-04, which mandates U.S. federal agencies to prioritize vulnerability remediation based on real-world risk signals rather than static CVSS scores. It emphasizes the need for rapid response timelines, forensic triage for high-risk vulnerabilities, and integration of threat intelligence with internal cloud context. Wiz's platform is presented as a solution to automate risk categorization, exposure validation, and triage workflows to meet compliance requirements in an AI-accelerated threat landscape.

3mo ago · wiz

Wiz Research developed Atlas, an autonomous AI system for vulnerability research, which has discovered over 200 previously unknown vulnerabilities in heavily audited open-source projects such as Kubernetes, Linux kernel, and gVisor. The system uses a multi-agent, adversarial validation approach to identify and confirm vulnerabilities with reproducible proof, minimizing false positives. One notable finding was a critical RCE vulnerability in GitHub (CVE-2026-3854), which led to the largest bug bounty payout in GitHub's history.

3mo ago · wiz

Wiz Research developed Atlas, an autonomous AI system for vulnerability research, which has discovered over 200 previously unknown vulnerabilities in heavily audited open-source projects such as grpc, dnsmasq, Kubernetes, and the Linux kernel. Atlas ranks #1 on CyberGym with a 90.9% success rate and uses a multi-agent, adversarial validation system to minimize false positives. Each finding is end-to-end validated with a working exploit, including the discovery of a critical RCE vulnerability in GitHub (CVE-2026-3854), which led to the largest bug bounty payout in GitHub's history.

3mo ago · wiz

Wiz Research discovered a series of critical unauthenticated Remote Code Execution (RCE) vulnerabilities in Ingress NGINX Controller for Kubernetes, collectively dubbed IngressNightmare. These vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974) allow attackers to inject malicious NGINX configurations and achieve remote code execution on the ingress controller pod, leading to full cluster compromise. The admission controller, which is exposed without authentication by default, enables exploitation by processing untrusted admission review requests. Over 43% of cloud environments are estimated to be vulnerable, with more than 6,500 clusters already exposed to the public internet.

3mo ago · wiz

FortiGate virtual appliances are being actively targeted by multiple threat actors due to their internet-facing nature and elevated privileges. Attackers exploit vulnerabilities such as CVE-2026-24858, CVE-2024-55591, and CVE-2022-41328 to gain access, create backdoor accounts, manipulate certificates, and establish lateral movement. These activities are often obscured by log deletion and weak configurations, making detection difficult without agentless visibility.

3mo ago · wiz

Wiz Research has identified active exploitation of a critical pre-authentication remote code execution vulnerability chain in WordPress Core, referred to as 'wp2shell'. The vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137, are being exploited in the wild to deploy persistent webshells on unpatched servers. Organizations are urged to prioritize patching or implement WAF-based mitigations to prevent compromise.

3mo ago · wiz

Wiz's agentless visibility capabilities have uncovered extensive threat activity across cloud environments, including exploitation of zero-day vulnerabilities in FortiGate and PAN-OS devices, credential stuffing campaigns, and supply chain attacks via malicious npm packages. Attackers are leveraging misconfigurations in Redis and MongoDB to achieve remote code execution and data exfiltration. Webshells are being deployed on WordPress instances via the wp2shell vulnerability, enabling persistent access and command execution. These findings highlight the risk posed by unmonitored virtual appliances and exposed services in cloud infrastructures.

3mo ago · wiz

A critical pre-authentication remote code execution (RCE) vulnerability chain in WordPress Core, dubbed 'wp2shell' and tracked as CVE-2026-63030 and CVE-2026-60137, is being actively exploited in the wild. The vulnerabilities allow unauthenticated attackers to execute arbitrary code on vulnerable WordPress instances, leading to webshell deployment, user enumeration, and admin panel access. Multiple threat actors have been observed exploiting these flaws, deploying both simple and sophisticated PHP webshells, while mass scanning campaigns suggest widespread opportunistic targeting.

3mo ago · wiz

In July 2026, an attacker exploited a misconfigured GitHub Actions workflow in the AsyncAPI generator repository using a 'pwn request' technique to steal a privileged Personal Access Token. The attacker published five malicious npm packages under the @asyncapi namespace, which download and execute a multi-stage payload establishing persistence and connecting to C2 infrastructure. The payload targets developer credentials, including browser data, SSH keys, and cloud tokens, and communicates via HTTP, Nostr relays, Ethereum smart contracts, and IPFS. The attack leverages infrastructure and obfuscation techniques linked to the Miasma framework but shows distinct characteristics from prior campaigns.

3mo ago · wiz

A business-logic flaw in a B2B platform's data API allowed unauthorized access to premium contact data without spending credits. The vulnerability stemmed from the backend trusting a client-controlled boolean flag 'unmaskContactData' without validating user entitlements. This enabled free-tier users to bypass paywall restrictions and extract unmasked business emails, phone numbers, and personal information at scale. The flaw highlights a critical gap in server-side authorization enforcement, which traditional security tools failed to detect.

3mo ago · wiz

The article discusses the importance of Infrastructure-as-Code (IaC) coverage as a security metric for cloud environments. It emphasizes that IaC coverage enables traceability, resilience, and compliance by ensuring cloud resources are defined and governed in code. The article introduces a funnel model—supportable, tracked, and mapped—to measure how well cloud infrastructure is governed through IaC, highlighting that higher coverage enables machine-speed remediation and better security posture.

3mo ago · wiz

The 2026 Verizon DBIR highlights that attackers are exploiting known vulnerabilities and trusted relationships at increasing speed and scale, with vulnerability exploitation now the leading initial access vector in 31% of breaches. Cloud environments are particularly at risk, as 40% of cloud intrusions begin with weaponized vulnerabilities. Attackers are leveraging AI to accelerate reconnaissance, exploit development, and post-compromise automation, while supply chain compromises and identity abuse further expand the attack surface.