Wiz Red Agent independently discovered and exploited a GitHub Actions vulnerability introduced by GitHub Copilot Autofix, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention.
Start your path to a self-healing cloud today, with Wiz Workflows now GA and Remediation and Response in public preview.
Powering cost investigation and optimization with deep cloud context
AI is changing the context around data risk, making it critical to understand what’s connected, what’s exposed, and why.
A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign.
Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix.
Reverse engineering Metabase CVE-2026-72898 with AI to accelerate defense.
Cloud and AI threat activity tracked by Wiz Research and CIRT, January through June 2026
Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation.
Announcing new capabilities that help organizations prepare for the AI era by expanding visibility and accelerating response, so security teams can defend at machine speed.
Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages.
As AI expands who builds software, the developer workstation is becoming a new security perimeter. AI and third-party software increasingly operate with access to your most sensitive credentials and cloud environments.
S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain.
Enterprise AI AppSec requires more than powerful models. It requires a system that balances speed, depth, and cost across the software lifecycle.
A critical vulnerability chain in Azure Cosmos DB enabled full read and write access to every Cosmos DB database.
Fast gets even faster: redefining security for the AI era and doubling down on our multicloud commit
Continuously uncover complex, exploitable risks to stay ahead in the AI Threat Era with the Red Agent
How unauthenticated Model Context Protocol (MCP) servers are opening doors to sensitive cloud data, IAM, and command execution.
Wiz enables organizations to continuously assess environments against the CISA KEV catalog, automating risk prioritization, rapid remediation, and forensic triage workflows.
See how Wiz built Atlas, an autonomous AI system for vulnerability research that validates every finding with a real, working exploit.
Mapping appliances event logs to real-world campaigns: A step-by-step researcher’s guide to continuous agentless monitoring.
How Agentless Workload Detection exposes hidden threats in virtual appliances and modern cloud networks.
As AI accelerates how organizations build and how attackers operate, a deeply connected security ecosystem is how defenders keep up.
Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations.
Part 3: How the Red Agent bypassed a credit and paywall system by changing a single client-side value from false to true.
