wiz.io on Hacker News

Gheist campaign plants secret-dumping workflows using stolen GitHub tokens(wiz.io)

44 points by acossta 19 hours ago | 0 comments

Wiz Research blog post analyzing Gheist, a campaign using stolen GitHub tokens to plant workflows that dump repository secrets, with IOCs and response guidance.

PHP2Shell: AI uncovers critical RCE in PHP(wiz.io)

398 points by danlark1 5 days ago | 184 comments

Wiz Research blog post detailing PHP2Shell, critical memory-safety and pre-auth RCE vulnerabilities in the core PHP engine found with help of frontier AI models.

AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira(wiz.io)

408 points by galnagli 2 months ago | 151 comments

Wiz blog post describing how its Red Agent autonomously exploited a GitHub Actions vulnerability introduced by a Copilot Autofix to access Snowflake's internal Jira.

CosmosEscape: Taking over Every Database in Azure Cosmos DB(wiz.io)

45 points by uvuv 2 months ago | 12 comments

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown(wiz.io)

424 points by bo0tzz 6 months ago | 89 comments

Wiz Research blog post detailing CVE-2026-3854, a critical flaw in GitHub's internal git infrastructure enabling remote code execution on GitHub.com and GitHub Enterprise Server.

Supply Chain Attack on Trivy(wiz.io)

6 points by tiri 7 months ago | 0 comments

Google closes deal to acquire Wiz(wiz.io)

309 points by aldarisbm 7 months ago | 184 comments

Hacking Moltbook(wiz.io)

369 points by galnagli 8 months ago | 228 comments

Wiz blog post describing how researchers found an exposed Moltbook database leaking 35,000 emails and 1.5M API keys from the AI-agent social network.

Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console(wiz.io)

123 points by uvuv 9 months ago | 27 comments

Critical RCE Vulnerabilities in React and Next.js(wiz.io)

113 points by gonepivoting 10 months ago | 50 comments

RediShell: Critical remote code execution vulnerability in Redis(wiz.io)

111 points by mihau 1 year ago | 45 comments

Critical vulnerability in AI coding platform Base44 allowing unauthorized access(wiz.io)

106 points by waldopat 1 year ago | 68 comments

How to harden GitHub Actions(wiz.io)

193 points by moyer 1 year ago | 65 comments

Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX(wiz.io)

56 points by puppion 1 year ago | 10 comments

RCE Vulnerabilities in K8s Ingress Nginx (9.8 CVE for ingress-Nginx)(wiz.io)

6 points by todsacerdoti 1 year ago | 1 comments

Exposed DeepSeek database leaking sensitive information, including chat history(wiz.io)

608 points by talhof8 1 year ago | 423 comments

Wiz Research blog post reporting a publicly accessible DeepSeek database exposing over a million log lines, including chat history and other sensitive data.

Wiz becomes the fastest-growing software company ever (2022)(wiz.io)

12 points by peter_d_sherman 2 years ago | 5 comments

SAPwned: SAP AI vulnerabilities expose customers' cloud environments and privat(wiz.io)

234 points by todsacerdoti 2 years ago | 56 comments

Data accidentally exposed by Microsoft AI researchers(wiz.io)

661 points by deepersprout 3 years ago | 212 comments

Wiz Research blog post describing how a misconfigured Azure SAS token in a Microsoft AI GitHub repository exposed 38TB of internal data, including Teams messages.

Compromised Microsoft key: More impactful than we thought(wiz.io)

238 points by 882542F3884314B 3 years ago | 64 comments

AAD misconfiguration led to Bing.com results manipulation, account takeover(wiz.io)

358 points by alosch7 3 years ago | 96 comments

Wiz Research blog post explaining how a common Azure Active Directory misconfiguration exposed Microsoft apps, enabling Bing.com result manipulation and account takeover.