3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs
How OAuth tokens, JWT fields and Entra sign-in logs reveal attacker behavior, and how to turn those signals into reliable detections.
#Research
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Detect and mitigate malicious npm packages linked to the recent Shai-Hulud-style campaign. Over 25,000 affected repositories across ~350 unique users.
Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks
How secure are top private AI companies? Find out from our scans and disclosures.
Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces
Wiz Research has uncovered 550+ secrets hiding in plain sight. We worked with Microsoft to shut the door.
Introducing HoneyBee: How We Automate Honeypot Deployment for Threat Research
Turning attacker insights into stronger cloud security protections.
RediShell: Critical Remote Code Execution Vulnerability (CVE-2025-49844) in Redis, 10 CVSS score
Wiz Research discovers vulnerability stemming from 13-year-old bug present in all Redis versions, used in 75% of cloud environments.
Defending against database ransomware attacks
How attackers exploit exposed databases for extortion—and the defenses that work.
Introducing zeroday.cloud: First-of-its-kind cloud and AI hacking competition
Wiz and the leading CSPs are launching one of the largest hacking competitions ever to secure the open-source software powering the cloud ecosystem
The emerging use of malware invoking AI
A closer look at LameHug, the Amazon Q Developer Extension compromise, s1ngularity, and PromptLock.
IMDS Abused: Hunting Rare Behaviors to Uncover Exploits
When common processes start asking the wrong questions
Beyond CVEs: The Exploitation of Everyday Misconfigurations
Exploring how simple setup flaws become open doors for attackers—and what teams can do to shut them.
Wiz Research Discovers One in Five Organizations Exposed to Systemic Risks in Vibe-Coded Applications - Here's How to Secure Them
New research reveals four common security risks systematically affecting vibe-coded applications - with remediation strategies curated together with Lovable.