Railway breach leads to $740,000 in fraudulent AI charges
Attackers stole environment secrets from at most about 100,000 workspaces after two infrastructure flaws.
1
Stories per day · 30 days
10 RSS
Relatedphp9ai-agents4coordinated-disclosure4openai4php2shell4appsec3credential-theft3wordpress3aspm2cloud2kubernetes2podcast2public-sector2rce2snyk2ai-credentials1ai-governance1ai-remediation1
78 stories, newest first · one card per story
Stories tagged #wiz
Wiz relaunches Cyber Model Arena to score agent cyber tasks
Version 3.9 tests 59 agents on 327 challenges with a 1,000-second budget and deterministic grading.
Wiz says it is not yet on Japan’s ISMAP cloud list
Wiz plans to start an external ISMAP assessment in early 2027 after a completed gap analysis.
Wiz Green Agent automates security remediation
Green Agent identifies issue owners, root causes, and generates environment-specific fixes to reduce mean time to remediation.
1
Northflank breach leads to abuse of customers' AI API keys
Customers must assume environment variables were decrypted; Northflank has not said how attackers got in or how many were affected.
1
Wiz survey: 83% of firms lack a full AI asset inventory
Of 100 security leaders, 55% run autonomous agents and 52% found unauthorized AI apps in the past year.
Wiz CTO says PHP cleanup continues after critical bugs
Schwartz says AI tooling found bugs that sat in PHP for more than a decade, and some sites are still unpatched.
PHP2Shell drew millions of exploit attempts; none succeeded, foundation says
Cloudflare saw millions of attempts within hours, while Calif, OpenAI and Wiz say AI helped turn long-known PHP issues into practical exploits.
Wiz describes ASPM prioritization with code-to-cloud context
The post explains finding enrichment, deduplication and attack-path scoring inside Wiz Code, not a new incident.
Wiz: PHP flaws back to 5.4 allow RCE or memory reads
Wiz says unauthenticated attackers can run code or read process memory that may hold passwords and tokens.
PHP2Shell flaws can give unauthenticated control of website servers
Calif and Wiz found the bugs; OpenAI helped PHP develop patches, and the NSA urged taking unpatched systems offline.
GPT-5.6 Sol and Gemini 4 Argon found a critical PHP flaw
OpenAI says the models found the issues before attackers, and a GitHub tool checks whether a PHP version is affected.
NSA warns of two critical PHP flaws present since version 5
OpenAI and Wiz say the holes were found before attackers; unpatched sites should go offline, and PHP 8.5.12 is recommended.
OpenAI coordinates fixes for critical PHP flaws found with GPT-5.6
Calif used GPT-5.6 Sol and Wiz independently reported both flaws; maintainers led the fixes and a version checker is available.
Wiz and Google Cloud preview native Wiz Sensor add-on for GKE
GKE Standard and Autopilot can enable the sensor with one flag; credentials stay in Secret Manager.
Wiz pipeline flags malicious npm packages before a CVE exists
Wiz says notable supply-chain attacks rose from about 10% of significant incidents in late 2025 to 1 in 4.
1
Wiz says AI agents ran multi-cloud intrusions end to end
One confirmed entry was Java remote code execution in an exposed Kafka UI, followed by malware and command-and-control.
11 Best Infrastructure as Code (IaC) Security Tools Compared (2026): Features & Pricing
A 2026 buyer's comparison ranks 11 IaC security scanners, platforms, and Terraform governance tools.
ASPM in the AI Era Part 1: Unified Visibility Across Your Stack
Wiz promotes ASPM connectors that centralize scanner findings and prioritize exploitable application risks.
Securing the Mission at Machine Speed: Wiz AI Agents Arrive in Wiz for Gov
Wiz makes its AI security agents available in FedRAMP High Wiz for Gov for U.S. agencies.
Top 10 Best IaC Security Tools in 2026 [Ranked & Scored]
A 2026 ranking puts Wiz, Snyk IaC, and Checkov atop ten infrastructure-as-code security tools.
12 Best ASPM Platforms Compared (2026): Features & Pricing
A 2026 buyer’s guide ranks twelve ASPM platforms, led by Apiiro, ArmorCode, and Cycode.
How the Wiz Red Agent caught a Fortune 500 firm’s data exposure (that other tools missed)
Wiz says Red Agent found a public sensitive-data page at an unnamed Fortune 500 financial firm.
Introducing Wiz AI SAST: Application Security that Understands Your Code and Your Infrastructure
Wiz launched AI SAST in public preview to find code flaws traditional scanners miss.