Emerging Threat: AI-Powered Malware Attacks
Recently there have been a few malicious campaigns involving attacker payloads that invoked AI. AI has been used by threat actors for all sorts of…
Category: CloudSecurity
New compliance guidance available: HITRUST i1 on AWS
We are pleased to announce the publication of a new AWS compliance implementation guidance: HITRUST i1 Compliance on AWS: Customer Implementation Guidance with an Illustrative…
Unifying Cloud Risk and Network Defense: Wiz and Check Point
A scan can find risks, but without context, it is impossible to know which ones truly matter. A vulnerability may look critical, but if it…
Why IaC Coverage Belongs on Your Security Dashboard
Every security domain has a number that tells you how much of it is under control. Identity has MFA adoption. Patching has mean time to…
Introducing zeroday.cloud: Cloud and AI Hacking Event
The Wiz Research team is proud to launch zeroday.cloud, a first-of-its-kind cloud hacking competition with a prize pool totaling up to about $4.5 million in…
The AI Attack Surface Explained
AI is changing the way organizations build, ship, and interact with software. And with it comes a new security reality. As more teams adopt generative…
Database Ransomware: How It Works and How to Stop It
Intro In recent years, attackers have increasingly turned to “malware-less” Living-off-the-Land operations against cloud and SaaS environments. This trend has also extended to extortion and…
Wiz Finds Critical Redis RCE Vulnerability: CVE‑2025‑49844
Wiz Research has uncovered a critical Remote Code Execution (RCE) vulnerability, CVE-2025-49844 which we’ve dubbed #RediShell, in the widely used Redis in-memory data structure store.…
HoneyBee: Automating Honeypots for Modern Threat Research
Honeypots are a powerful tool in threat research. They are intentionally vulnerable systems designed to attract attackers, allowing researchers to observe their techniques and learn…
Supply Chain Risk in VSCode Extension Marketplaces
Wiz Research identified a pattern of secret leakage by publishers of VSCode IDE Extensions. This occurred across both the VSCode and Open VSX marketplaces, the…
The Foundation Modern AppSec Is Still Missing: Code to Cloud, Rebuilt the Right Way
Modern development practices mean everything is defined in code: containers, infrastructure, APIs, and CI workflows. But security hasn’t kept up. Siloed scanners like SCA, IaC…
Bringing Visibility to Kubernetes: Unified Inventory and Network Insight
Kubernetes has become the foundation of how teams build and run modern applications. It simplifies the deployment and management of containers across environments, but that…