7 casos · pág. 1/1
Wiz announced that its Wiz AI Agents are now available in Wiz for U.S. Government (Wiz for Gov), its FedRAMP High authorized environment. Wiz describes this as the first AI-Application Protection Platform (AI-APP) for U.S. public sector organizations that protect highly sensitive, national security and mission-critical data. This is vendo…
Wiz and Google Cloud announced the Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE) in Preview. It is available for both GKE Standard and Autopilot clusters. GKE manages sensor deployment, credential injection and lifecycle updates through the control plane, which removes manual Helm and manifest handling. The sensor uses eBPF…
The Wiz Customer Incident Response Team (CIRT) reports a rising pattern of LLMjacking in which threat actors compromise privileged Google Cloud Platform (GCP) users solely to offload the cost of large-scale LLM inference onto the victim. Attackers link external, attacker-controlled GCP projects to the victim's billing account, so all Gemi…
Wiz describes a supply chain detection pipeline that analyzes new npm package versions at publication, so malicious releases can be flagged before a CVE or advisory exists. Wiz Research says notable supply chain attacks rose from about 10% of significant incidents in H2 2025 to 25% in H1 2026. The article cites two compromises: the Axios …
The Wiz Customer Incident Response Team (CIRT) reports a growing number of intrusions in which an AI agent system ran the entire operation: finding entry points, harvesting credentials, pivoting across platforms and debugging its own scripts in real time. In one investigated case, the agent compromised a large multi-cloud organization (GC…
Wiz published the first part of a blog series on operationalizing Application Security Posture Management (ASPM) with Wiz Code. It argues that AI models that find vulnerabilities and generate exploits, combined with AI-accelerated development, break manual AppSec triage workflows. The article uses React2Shell (CVE-2025-55182), a critical …
Wiz Research disclosed multiple memory-safety vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, and patched by the PHP team on October 21, 2026. The flaws allow unauthenticated remote code execution or disclosure of process memory (passwords, tokens, API keys, certificates) on any site running an…
