Wiz Blog

"...So what should you do instead? Well there’s really no good answer here. Probably the best thing to do is to use the generic 'TLS' identifier..." https://www.wiz.io/, a popular code cyber analysis tool, will flag "TLS" as a SAST issue. :(

On the follow up Wiz blog they suggested that the exfiltration was cross-victim https://www.wiz.io/blog/shai-hulud-2-0-aftermath-ongoing-supply-chain-…

It is one of the fastest growing companies in the cybersecurity space. 6x ARR is quite low for that. 15x is a great deal for Google. I think Wiz accepted 15x because it is all-cash. The rate at which they are still growing, a series C/D company would dream of. [1] https://www.wiz.io/blog/100m-arr-in-18-months-wiz-becomes-the-fastest-…

Ah yes, classic staying lean and exposing your database[0] https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-databas…

There are so many that it's just not funny. :( • https://www.nbcnews.com/tech/security/scathing-federal-report-rips-mic… • https://www.wiz.io/blog/bingbang • https://www.theverge.com/2023/7/12/23792371/security-breach-china-us-g… • https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-an… These are just the first few I've found for the last 12 months. There are more if you go back even 12 months further, and I'm pretty sure the above aren't the complete list for the last year anyway. Microsoft are actually really bad at this Cloud "security" thing. :( :( :(

Apparently another Google web framework... I had never heard of it, but I know this company called Wiz and thought it may be related for a second: https://www.wiz.io/

Here are few big ones from the past 12 months. https://www.wiz.io/blog/bingbang https://www.theverge.com/2023/7/12/23792371/security-breach-china-us-g… https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-an… I would agree, the Windows OS has really matured since XP, from a security perspective at least. I would definitely expect better than this from a tech giant like MS. When was the last time Google, Meta, or Apple got breached like this? Edited to add, I think them open sourcing some security training is good, it benefits everyone whether or not MS themselves are a great example of a secure company.

Found following from the links from the post: 2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry [1], Source[2], German source) Also the following: https://infosec.exchange/@briankrebs/110820474957163710 Quite damning if true. [1]: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-s… [2]: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-a…

I would find a new name. https://www.wiz.io

This deal isn't about security, it's about data. Google already have one of the best security teams in the industry - Project Zero [0]. They don't need Wiz's "enterprise" expertise for security. This deal is about DATA. Wiz, as a cybersecurity vendor, have full remote access to their customers cloud compute storage (EC2 EBS volumes, etc) in the name of "security scanning" - this is actually part of their unique selling point - "agent-less scanning" which is unlike traditional security tools that require an agent installed in the OS. Instead, Wiz is able to just clone your full data volume and scan it locally in their cloud accounts/VPC. With this deal Google has bought a ton of confidential data from Wiz's customers without their explicit knowledge or approval, and they will use it to improve Google's AI models like Gemini and probably several other products. A year ago Google struck a $60M/yr deal with Reddit to exclusively license their content [1] for the same reason, and that data is probably much smaller and less valuable than the data Wiz has access to from their customers, which include companies like Morgan Stanley, DocuSign, Slack, Plaid, and others. [2] Sources: 0: https://googleprojectzero.blogspot.com 1: https://www.reuters.com/technology/reddit-ai-content-licensing-deal-wi… 2: https://www.wiz.io/customers

They were before 2023, when things worked ... So a "component" failed? That sounds like a software component. We just saw in https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug how sloppy bot coding is.

Yes. you're thinking of https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerabili…

They can exploit binaries too eg see this vulnerability in github https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

This will not reassure you, but the reason it isn't necessarily really bad is because it's only incrementally worse than the really bad news came out last month: Security researchers identified a series of exploitable vulnerabilities in github.com by using LLMs to review the compiled GitHub Enterprise Server binaries: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

I found these references to Mullvad and TeamPCP >The whole operation ran primarily from Mullvad VPN exit nodes and virtual private server infrastructure, with little effort made to blend in. This was a high-tempo, low-stealth campaign designed to extract as much value as possible, as fast as possible.[1] >Wiz CIRT observed the bulk of TeamPCP’s activity originating from Mullvad Virtual Private Network (VPN) exit nodes and virtual private server hosts such as InterServer.[2] 1: https://www.oligo.security/blog/teampcp-campaign-the-evolution-of-mode… 2: https://www.wiz.io/blog/tracking-teampcp-investigating-post-compromise…

Tenant scoping is important. Just ask Microsoft, didn't they have one right at bing.com? Oh, just every Bing user is vulnerable to have all Microsoft data (o365 emails for example) hacked. No biggie. https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration

The tweet is confusing and makes it sound like the RCE was as simple as `git push -o "x;`whatever command`"`, but there are a few more things they have to specify that they mention in their blog post: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 It doesn't look like it's very hard to reproduce or find the bug now (especially with the details they mention in their blog post) but I assume they did not want to publish the actual command line. It looks like it affected both GitHub.com and GitHub Enterprise, and it does look like it literally took one git push command.

It looks like Trivy was compromised at least five days ago. https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack

Mentioned by both Trivy (aquasecurity) (84 points, 3 days ago, 30 comments) https://news.ycombinator.com/item?id=47450142 Wiz (3 points) https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack

There already is an integration with SecOps: https://www.wiz.io/integrations/google-security-operations and https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrat… Is that the kind of integration you are refering to?

It was revealed by this post by Wiz from the beginning of this month: https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-…

This was on HN a few days ago, I wasn't counting anything: https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-…

The sec. vulns just keep coming: https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-…

Actual article: https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-… (https://news.ycombinator.com/item?id=46857615)

For more info - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack

We're monitoring this activity as well and updating the list of affected packages here: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack Currently reverse engineering the malicious payload and will share our findings within the next few hours.

"Not really true"?! TRUE AS HELL! "Outlook New" LITERALLY DOES THAT! It's an infostealer. Microsoft gets your login info and downloads your mails, contacts and calenders to its own servers! How this app is legal and not marked as malware is beyond me! It's the biggest information heists in history! https://www.heise.de/en/news/Microsoft-lays-hands-on-login-data-Beware… https://cybernews.com/privacy/new-outlook-copies-user-emails-to-micros… > If they betray trust on such a scale, and we find out, they'll be out of business. The decision makers don't care. They could eat children and they still would buy from them. https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-a…

Interesting. According to https://www.wiz.io/blog/s1ngularity-supply-chain-attack the initial entry point was a "flawed GitHub Actions workflow that allowed code injection through unsanitized pull request titles" — which was detected and mitigated on August 29. That was more than ten days ago, and yet major packages were compromised yesterday. How?

In all cases, having zero auth at all [0] even when others want to use it as a service to broadcast across the internet is ridiculous. Leading to problems like this: [1] and now all exposed without any protection. Even allowing others to change the $OLLAMA_HOST env is a security footgun. [0] https://github.com/ollama/ollama/issues/849 [1] https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032