Featured
The Pwn Request Reckoning: What Still Works Against GitHub Actions
GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it.
Blog
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
ASPM in the AI Era Part 2: Prioritize Exploitable Risks with Code-to-Cloud Context
Reduce triage times and focus on the risks that matter most by combining context across code, infrastructure, and runtime
ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
Wiz Research is tracking an ARTEX-using actor, overlapping with Storm-0940, across multiple targeted software vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs.
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
LiteLLM Compromised, Steals Credentials
In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a credential stealer targeting browser, cloud and AI secrets as well as a dormant C2 capability.
Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native.
Enable native runtime protection for GKE in just one click. The Wiz Runtime Sensor add-on now automates deployment and credential management while delivering predictable, kernel-level eBPF threat detection for your GKE Kubernetes fleets.
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage
Supply Chain Zero Days: Closing the Gap Between Publication and Detection
When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published
Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack
Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them.
ASPM in the AI Era Part 1: Unified Visibility Across Your Stack
Integrate your existing code scanners into Wiz for a unified view of application risk across your environment.
Securing the Mission at Machine Speed: Wiz AI Agents Arrive in Wiz for Gov
Wiz AI Agents elevate traditional CNAPP, empowering public sector security teams to accelerate security and innovation.
How the Wiz Red Agent caught a Fortune 500 firm’s data exposure (that other tools missed)
Traditional DSPM and classification tools scan from the inside out. Thinking like an attacker, the Red Agent found a public page exposing sensitive data in minutes.
Introducing Wiz AI SAST: Application Security that Understands Your Code and Your Infrastructure
Find, validate, and fix complex business logic flaws with an AI code scanner backed by Wiz Research, operationalized within your existing security program.
What’s New in Wiz Service Catalog: Smarter Discovery, Governance, and Service-Level Context
Build your Service Catalog faster, keep service context current, and give teams a clearer path from cloud risk to accountability
Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts
Secure your Kubernetes supply chain with WizOS Helm Charts. Eliminate hidden CI/CD risks and unmaintained dependencies with hardened, signed, and CVE-scanned charts for seamless Kubernetes deployment.
The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub
See how the Blue Agent investigated a multi-platform attack in minutes, following evidence across AWS and GitHub to uncover compromised credentials, stolen source code, and custom data exfiltration tooling
Introducing the Wiz Partner Alliance Managed Service Provider Program
Empowering managed services partners to deliver world-class cloud and AI security at scale
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz Research analyzes NordStellar data to map the credentials targeted by infostealer families and assess their potential impact across cloud, code, and AI environments.
Wiz Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026
Forrester’s Proactive Security Platforms evaluation rated Wiz with top scores across eight areas, reflecting our commitment to securing the AI era
Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure
New initiative partners with under-resourced organizations to uncover, remediate exploitable risk at scale.
Growing the WIN AI Ecosystem with Agent Integrations
WINning AI with AI: How the Wiz MCP for WIN partners accelerates a connected ecosystem
Exploring the new AWS Sign Up experience
This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.
Building an AI Detection Engine That Understands Agent Intent
Analyzing model input and output logs in an AI-native detection pipeline to understand and uncover malicious AI agent behavior