The Red Agent POV: The One Boolean That Broke a B2B Platform’s Credit System
Part 3: How the Red Agent bypassed a credit and paywall system by changing a single client-side value from false to true.
#Research
M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
Detect and mitigate malicious @asyncapi npm packages linked to the latest npm supply chain attack.
Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense
Verizon's latest DBIR highlights how attackers are exploiting familiar weaknesses at increasing speed and scale. Here's what Wiz research reveals about vulnerabilities, trust relationships, and AI in modern cloud environments.
GhostApproval: A Trust Boundary Gap in AI Coding Assistants
Uncovering a category-level blind spot in modern AI coding assistants, and why the Human-in-the-Loop safety model fails against this classic threat
The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes
MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension
By automatically loading MCP servers from workspace files, Amazon Q enabled attackers to execute code and access sensitive cloud environments.
Introducing the Red Agent POV Series
An inside look at how the Red Agent, our AI-Powered Attacker, uncovers complex, exploitable risks in the wild
Miasma: Supply Chain Attack Targeting RedHat npm Packages
Detect and mitigate malicious npm packages linked to the latest npm supply chain attack, based on the open sourced Mini Shai-Hulud malware.
State of Post Quantum Cryptography
Discussion of PQC relevant statistics that we see across our customers and other data sources.
Commit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure
Wiz CIRT and Wiz Research detail JINX-0164, a threat actor using LinkedIn social engineering, custom macOS malware, and CI/CD hijacking to target cryptocurrency organizations.
State of SDLC Security 2026: How Risk Scales in Modern Development
Insights from real-world environments into how code, developer tooling, automation, and AI are reshaping application security.
durabletask: TeamPCP's Latest PyPi Compromise
Discover the latest on malicious versions of the pypi package durabletask, matching TeamPCP tactics.