Wiz Service Catalog: Expand Risk Visibility & Ownership
When ownership breaks down, remediation slows down. Modern cloud environments are complex: distributed microservices, APIs, containers, and ephemeral components make it hard for developers to…
Category: CloudSecurity
Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact
Wiz Research and Wiz CIRT have been responding to the Shai-Hulud 2.0 incident (aka Sha1-Hulud) since news first broke on November 24, 2025. As of…
Wiz Exposure Management GA Release: Unifying UVM + ASM
We’re excited to announce the General Availability (GA) of Wiz Exposure Management, featuring our powerful new capabilities: Wiz Unified Vulnerability Management (UVM) and Wiz Attack…
Wiz reaches $1B in AWS Marketplace Lifetime Sales
Wiz has surpassed $1 billion in lifetime sales in AWS Marketplace, becoming the fastest security ISV in history to reach this milestone. Wiz and AWS…
Introducing Wiz SAST: Where Code Risk Meets Cloud Context
Modern development practices and AI copilots have dramatically increased the volume and velocity of code, with developers often moving from prompt → tab → commit…
Wiz Product Announcements at re:Invent 2025
AWS re:Invent is about rethinking what’s possible in the cloud. This year’s agenda is jam-packed with sessions about AI, infrastructure innovations, and of course, security.…
React2Shell (CVE-2025-55182): Critical React Vulnerability
TL;DR: CVE-2025-55182 is a critical unauthenticated RCE vulnerabilities in the React Server Components (RSC) “Flight” protocol. Default configurations are vulnerable – a standard Next.js app…
Top AWS re:Invent Announcements for Security Teams in 2025
AWS’s largest event of the year is re:Invent, which occurred just after Thanksgiving from Dec 2-5 this year. The weeks prior are referred to as…
Code to Cloud Attacks: Github PAT to Cloud Control Plane
Threat actors are targeting GitHub Personal Access Tokens (PAT) as high-value entry points, leveraging compromised PATs to gain initial access to victim cloud environments. Historically,…
Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited
While investigating a malware infection on a customer workload, Wiz Research discovered an active zero-day vulnerability in Gogs, a popular self-hosted Git service. A symlink…
Zero‑Days in the Age of AI: Behind the Scenes of ZeroDay.cloud 2025, with a Record High of CVEs in Critical Cloud Infra
The zeroday.cloud competition may be over, but the race is just beginning. Last week in London, Wiz Research hosted a first-of-its-kind cloud hacking competition in…
MCP to Vibe Coding Full Endpoint Visibility in AI Security
Introduction Everywhere AI is being adopted, new application endpoints appear. From Vibe Coding tools to large-scale model APIs and pipelines, these endpoints are the front…