Code to Cloud Attacks: Github PAT to Cloud Control Plane
Threat actors are targeting GitHub Personal Access Tokens (PAT) as high-value entry points, leveraging compromised PATs to gain initial access to victim cloud environments. Historically,…
Category: CloudSecurity
Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited
While investigating a malware infection on a customer workload, Wiz Research discovered an active zero-day vulnerability in Gogs, a popular self-hosted Git service. A symlink…
Zero‑Days in the Age of AI: Behind the Scenes of ZeroDay.cloud 2025, with a Record High of CVEs in Critical Cloud Infra
The zeroday.cloud competition may be over, but the race is just beginning. Last week in London, Wiz Research hosted a first-of-its-kind cloud hacking competition in…
MCP to Vibe Coding Full Endpoint Visibility in AI Security
Introduction Everywhere AI is being adopted, new application endpoints appear. From Vibe Coding tools to large-scale model APIs and pipelines, these endpoints are the front…
Wiz Adds OCI IAM to Unified Cloud Identity Graph
Identity is the backbone of cloud security. It defines who can access what, and it’s often the difference between a secure environment and an open…
Kenna EOL and the Shift to Exposure Management
Cisco has officially announced the end-of-sale and end-of-life dates for Cisco Vulnerability Management (formerly Kenna Security), including its Vulnerability Intelligence and Application Security Modules. While…
MongoBleed: Critical MongoDB Vulnerability CVE-2025-14847
MongoDB has disclosed a high-severity unauthenticated information leak vulnerability, tracked as CVE-2025-14847 and dubbed MongoBleed (after HeartBleed), affecting multiple supported and legacy MongoDB Server versions.…
Validated External Risk Issues: SOC Alerts for Zero-Days
The ultimate goal of modern security is simple: removing exploitable risk before attackers can find and weaponize it. High-profile threats continually prove the importance of…
Snipping the Long Tail of Shai-Hulud 2.0
Since the discovery of Shai-Hulud 2.0 (aka sha1-hulud), Wiz Research has tracked a persistent “long tail” of infections. To date, this incident has impacted over…
Expanding the Zero Critical Club to set a new standard for AppSec and SecOps teams
Security teams today are caught in a difficult position. Development teams are shipping features faster than ever, naturally expanding the attack surface, while attackers are…
Wiz Recognized as a 2025 Customers’ Choice in the Gartner® Peer Insights Voice of the Customer for CNAPP
At Wiz, everything starts with the trust our customers place in us. The insights and experiences shared by practitioners guide our roadmap and drive the…
Introducing the Wiz Partner Alliance: Build & Grow
At Wiz, we believe the best cloud security outcomes happen when we work together. Our partners play a critical role in operationalizing Wiz, helping customers…