Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.
How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft.
Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft.
Detect and mitigate CVE-2025-14847, an unauthenticated information leak vulnerability in MongoDB. Exploitation has been observed in the wild. Organizations should patch urgently.
Wiz Threat Research has observed exploitation in-the-wild of CVE-2025-8110
Turning attacker insights into stronger cloud security protections.
Understanding the risks and impact of deploying dev-mode in production environments
Cloud environments at risk: Attackers target weak PostgreSQL instances with fileless cryptominer payloads.
Wiz Threat Research uncovered a new malware campaign targeting Linux environments attributed to the Diicot threat group.
