Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory (CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329). Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control.
Delivering unified cloud security and accelerating secure modernization to protect citizen data and critical infrastructure.
How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft.
Fixing security vulnerabilities in code takes seconds, while patching in production creates high operational costs and risk. Discover how empowering developers as your first line of defense eliminates exposure across every phase of your software pipeline.
Detect exposure to new vulnerabilities the moment they are published with Wiz CVA
Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft.
Inside the multi-agent pipeline and feedback loops that turned a bucket scanner into a context engine.
A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services.
How the Wiz Cloud Cost automates cost allocation to power developer-led cost optimization and connect cost to business value.
Wiz Research telemetry reveals why the majority of high-severity findings lack a path to compromise
Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios.
Transform point-in-time pen-tests into continuous exposure management with unified platform combining pen-test findings and real-time cloud context
Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attacks.
Recognizing the partners, integrators, and visionaries driving cloud security transformation, AI risk management, and SOC modernization across AMER, EMEA, and ANZ.
Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live.
Start your path to a self-healing cloud today, with Wiz Workflows now GA and Remediation and Response in public preview.
Powering cost investigation and optimization with deep cloud context
AI is changing the context around data risk, making it critical to understand what’s connected, what’s exposed, and why.
A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign.
Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix.
Reverse engineering Metabase CVE-2026-72898 with AI to accelerate defense.
Cloud and AI threat activity tracked by Wiz Research and CIRT, January through June 2026
Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation.
Announcing new capabilities that help organizations prepare for the AI era by expanding visibility and accelerating response, so security teams can defend at machine speed.
Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages.
