RediShell security flaw in Redis: -remotely exploitable -CVSSv3 10/10 -impacts all versions released over the past 13 years -impacts 75% of cloud instances www.wiz.io/blog/wiz-res... redis.io/blog/securit...

New threat hunting blogpost from our team - by checking which Linux processes normally use the Instance Metadata Service across thousands of cloud environments, we can identify exploitation of novel SSRF & RCE vulnerabilities when a process that shouldn't use IMDS suddenly does.

Open-source supply chain attacks are often in the news, but they aren't all equally deserving of your time and attention - here's how they usually happen, and key questions to decide which ones are worth worrying about:

💡 Eden hosts Nichole Dove, @sherrod.bsky.social & @alonsch.bsky.social. Cloud chaos, career confessions & the future of cybersecurity. This one hits different. Listen now: 🍏 open.spotify.com/episode/6vGW... 🎧 podcasts.apple.com/us/podcast/l... 📺 www.youtube.com/watch?v=7Kwi...

these blippi recasts are getting out of hand

🚨 New Wiz research: Active exploitation of Ivanti EPMM flaws (CVE-2025-4427 & 4428) enables RCE in the wild. Cloud systems are at risk; patch now. Wiz customers can find pre-built detection queries in the Threat Intelligence Center. Full details 👉 www.wiz.io/blog/ivanti-...

'Ongoing' Ivanti hijack bug exploitation reaches clouds

Our team at Wiz Research has observed ongoing exploitation of the latest Ivanti EPMM vulnerabilities (CVE-2025-4427 & CVE-2025-4428) - more details and IOCs available here: www.wiz.io/blog/ivanti-...

If you'd like to learn more about this type of misconfiguration, how it can be exploited, and how to prevent it, @danielleaminov.bsky.social from my team at Wiz wrote a great introduction to this topic here: www.wiz.io/blog/spring-...

wife: how was guarding the two paths today, honey? guard: [looking away] fine wife: did something happen? guard: [tearing up] no wife: would the other guard tell me something happened?

So an expert on sin, but also cos and tan

🎙️All you need to know on bug bounty insights w/ @rhynorater.bsky.social! @amitaico.bsky.social & Eden dive into hacks, lessons & wild stories on Crying Out Cloud. 🔗 Listen now: 🍏 podcasts.apple.com/us/podcast/b... 🎧 open.spotify.com/episode/6B6q... 📺 youtube.com/watch?v=eW6k...

🚨 OH NOOOO! Someone stole the secret recipe of ExfilCola. We need your help tomorrow to get it back. Set your clocks for 9 a.m. ET ⏰ You'll need curiosity, cloud IR skills, and a taste for solving mysteries. 🧠 Do you think you can crack it?

This. is. massive! 🥁✨ Meet the Wiz Vulnerability Database—for CVEs that actually matter in the cloud. AI-powered reports, expert insights & fix guidance. No fluff, just essentials. 🔍 Explore: wiz.io/vulnerabilit...

#IngressNightmare: Wiz Research uncovers a critical vulnerability in Ingress-NGINX 🚨 Wiz Research found a novel attack vector in one of Kubernetes's most fundamental projects, Ingress-NGINX, which is rated CVSS 9.8.

BREAKING: Internal #DeepSeek database publicly exposed 🚨 Wiz Research has discovered "DeepLeak" - a publicly accessible ClickHouse database belonging to DeepSeek, exposing highly sensitive information, including secret keys, plain-text chat messages, backend details, and logs.

New phone, Houthis

Pantheon is such an amazing show, I feel so late to the game only watching it now. I also appreciate how it was released slightly before Gen AI became mainstream, otherwise I suspect the script might have been different. Almost makes it seem like an alternate history.

Turns out when you investigate a compromised Github Actions you ... find another compromised Github Action: www.wiz.io/blog/new-git...

What an honor to share our talk on “In-the-Wild Abuse of App Misconfigs” at @districtcon.bsky.social year 0! So much talent in one place, and massive kudos to the organizers for creating such an epic event and overcoming an entire-block power outage. Looking forward to next year! 🪩✨🌸

📢 JUST DROPPED: Analyzing 150K+ cloud accounts, we took a deep dive into #AI adoption. And the results? Wild.

This is cool @feedly.com. Thanks for working with us on it. It's true- Feedly uplevels our detection game in a big way @ GreyNoise. feedly.com/customers/po...

Why is everyone suddenly talking about #DeepSeek? 👀 Our new podcast features Gal Nagli from the Wiz Research team, breaking it down with Eden Naftali and @amitaico.bsky.social. 🔗 Listen now: 🍏 podcasts.apple.com/us/podcast/d... 🎧 open.spotify.com/episode/5HIP...

maybe I am too old and crotchety, but kinda feel like getting an LLM to answer your questions if they are naughty bad questions should not really qualify as a "security flaw"

I get what they're trying to do, but this isn't an ideal solution. Would be better if MITRE / NIST maintained an EOL enumeration database similar to CVE. Meanwhile, for those not familiar, endoflife.date is a great reference for determining which versions of popular software are EOL.

Learn more on how to shifting focus on attacker behavior — ⚙️ like unusual permissions escalations or lateral movement patterns in our blog by @merav-b.bsky.social & and Gili Tikochinski: www.wiz.io/blog/detecti...

🔍 Behavioral #IOCs are the future of cloud security. Learn how focusing on attacker behavior helps detect threats faster and more accurately.

Our IR team has been investigating exploitation of the recent Aviatrix Controller RCE (CVE-2024-50603). So far impact has been limited to cryptojacking, but Aviatrix Controller's default roles enable control plane privilege escalation to admin, so be sure to patch ASAP. www.wiz.io/blog/wiz-res...

Our dev team discovered a Nuclei signature verification bypass enabling code execution - while only practically exploitable in very specific usecases, the vulnerability itself is interesting and the write-up from Guy is really good:

Check out our new research blogpost about new developments related to Diicot - new tools, new techniques, new context-aware behavior. www.wiz.io/blog/diicot-...

Check out the full blog for detailed analysis, technical examples, and tips on securing your Spring Boot Actuator deployments 🪄: www.wiz.io/blog/spring-...

I was looking into how organizations deploy Spring Boot Actuator in the cloud and found 1 in 4 exposed Actuators had security flaws leading to data leaks or RCE. These risks are more common than you'd think..⚠️

For Christmas, the Three Buddy Problem pod will be looking back at the best security research that was published in 2024. Special buddy cookies to those who were outstanding. Extra points for obscure ones! @craiu.bsky.social @jags.bsky.social Link: docs.google.com/forms/d/e/1F...

Curious how global warming might affect the accuracy of this type of model considering its historical training data. deepmind.google/discover/blo...

Apparent supply chain attack on Ultralytics, a popular AI Python library. Threat actor managed to insert cryptojacking functionality into specific versions (which have since been removed from PyPI). github.com/ultralytics/...

Eden and I recently had an interesting conversation with Johann Rehberger about AI security and redteaming in general (you can tell it was interesting based on my thinking pose): www.youtube.com/watch?v=Ra9m...

We released Censeye today, an open source CLI tool that makes it dramatically easier to pivot and find related assets when threat hunting on Censys instead of manually checking for potential identifying characteristics like an SSH host key. github.com/Censys-Resea...

DistrictCon Talks Have Been Selected🎙️ www.districtcon.org/speakers Check out our incredible speaker lineup for DistrictCon 2025. Agenda (and more talk announcements) coming soon

Reminds me that I once used to switch fonts to comic sans when reviewing other people's reports, to make sure that font choice wasn't biasing my opinion (if it still reads well in comic sans it's probably good stuff, and vice versa).

A version of Missile Command for the Commodore 64 where the bottom of your screen is the game state in memory and missiles cause memory corruption: csdb.dk/release/?id=.... In the video below, a missile broke my controls and caused my cursor to get stuck moving down and to the left.

*downselection of activity not to scale

I’ve created a Starter Pack around cyber threat intelligence to make it easier to find that community here on Bluesky. Let me know of folks I missed, as I’m sure there are many! go.bsky.app/TxQYHap

We've been observing ongoing exploitation of the recent PAN-OS RCE vuln chain (CVE-2024-0012+CVE-2024-9474) over the past few days and we're sharing our research findings and a few IOCs: www.wiz.io/blog/cve-202...

Hi folks, I've been a bit hesitant to start using yet another social network, but it seems like this is the good place at the moment 🙂

I made a Detection Engineering starter pack, will be adding more as more folks jump over to bluesky! go.bsky.app/HenXJUR