Wiz (@wiz_io) / X

Pinned

🚨 BREAKING: Wiz Research discovered Remote Code Execution on GitHub.com with a single git push The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

Wiz ASM just got smarter: Find any exploitable risk, anywhere 💥 Wiz ASM + Red Agent discovers every asset and uncovers every risk, from known vulnerabilities to hidden flaws.

Wiz ASM for any environment, any risk, everywhere | Wiz Blog

Today we're excited to announce GA of Wiz MCP 🪄 connecting AI assistants, custom agents and AI apps directly to Wiz with trusted security context, intelligence and reusable security Skills.

Introducing Wiz MCP: Build AI Security Agents with Wiz | Wiz Blog

✈️ Our Red Agent found its way into an airline booking database in just 15 minutes. Starting with only the airline's homepage, it uncovered a BOLA flaw and exposed booking records - reasoning like a real attacker, not just scanning.

The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API | Wiz Blog

How I bypassed a stubborn url parser to exploit SSRF and leak production GCP Cloud Credentials

The Red Agent POV: How it Reasoned its Way to SSRF | Wiz Blog

🪄 Red Agent (@wizredagent) was able to autonomously hack an Airline in 10 minutes, and gain full control over past and current bookings. All it did was change some numerical ID it found on the publicly facing code of ✈️ (www.airline[.]com) Read more -> wiz.io/blog/red-agent…

🚨Wiz Research update: MCP Auto-Execution: From Git Clone to Cloud Compromise. This let malicious repos run code and steal AWS credentials without consent via workspace MCP configs. Attackers could compromise cloud envs. Fixed in language server 1.65.0 (CVE-2026-12957).

wiz.io

Amazon Q Vulnerability: Compromise via MCP Auto-Execution | Wiz Blog

Wiz Research found a critical Amazon Q vulnerability that enabled code execution and cloud credential theft through malicious MCP configurations.

📢 Wiz Sensor-based Workload Scanner is GA! Now extending Wiz risk visibility to on-prem. One Security Graph for cloud + on-prem, unified risk prioritization and full attack path visibility. Read more:

Bridging the Visibility Gap: A Unified Security Operating Model for Hybrid Cloud Teams | Wiz Blog

👀 Look closer: Wiz is bringing runtime signals into the Security Graph 👏🏻 We found that 1 in 6 cloud environments had a critical attack path hidden in live network connections - completely invisible to config only analysis. Read more:

Uncovering Hidden Attack Paths in Cloud Environments Using Runtime Signals | Wiz Blog

🤖 AI is rewriting the SecOps playbook. As environments speed up, defenders have less time to understand what’s happening. Context is becoming the most critical asset in security operations. Win: context + speed.

How AI is Rewriting the SecOps Playbook | Wiz Blog

AI changed the rules. We built a new playbook 📝 4 pillars: 1 reduce exposures & AI scan 2 accelerate patching & response 3 AI-native code analysis. 4 Detect and contain AI-powered threats Exploitability > visibility. learn more:

AI Threat Readiness Pillar 4: Detect and contain threats in real-time | Wiz Blog

🎁 We're looking for 1 SOC team to receive the ULTIMATE OFFICE GLOW-UP 🏆 INTRODUCING 🎉 Wiz's PIMP MY SOC! How to enter? 1) In the comments, tell us why your SOC team is the MVP of your company 2) Tag your teammates in the comment LETS GO 👇

Wiz Red Agent is the world's largest AI-Powered Attacker solution, with over 1,000+ customers and hundreds of thousands of assets scanned every week. Excited to start sharing what it finds with a new series breaking down real, 100% autonomous findings on production assets 👇

🍦 JUST DROPPED: CISO SCOOPS 🍦 The best way to cool down a CISO this summer? ICE CREAM 😎 >> cisotopia.com/cisoscoops Inspired by what security teams deal with every day.

1

2

606

See Wiz’s full profile