Pinned Tweet
We have been reverse engineering the XZ Utils backdoor and are sharing some initial findings: we've identified multiple hooking options to adapt to different environments, and a hardcoded fake public key that can appear in verbose SSH logs depending on attacker-controlled flags.
Danielle Aminov retweeted
I guess you could say the past 48 hours have been a bit busy for cyber defenders
Danielle Aminov retweeted
If today's arrests are the PCPCU's Endgame, then this H1 profile is surely the rat in the van.
Danielle Aminov retweeted
Attackers are using AI to make Entra ID registered devices look… normal.
Defenders must adapt:
• Drop static identifiers
• Focus on behavioral detection
• Correlate activity across the attack chain
wiz.io/blog/detecting-entra-…
Danielle Aminov retweeted
Our AI attacker autonomously made its way into @Snowflake's internal Jira, accessing sensitive data simply by opening a public GitHub issue with a crafted title.
The flaw was introduced 5 days earlier by "Copilot Autofix powered by AI" 🪄 🧵
Danielle Aminov retweeted
While the keyv worm's tail is still unfurling, it's important to recognize that not all malicious packages are alike. In this case, the vast majority of the exposure is so far isolated to the initial seed compromise:
Danielle Aminov retweeted
A lot of cloud service providers beyond AWS allow you to store data in something that looks and acts like S3, but there are differences worth investigating. Check out my latest article discussing the security risks that carry over and the assumptions that break.
wiz.io/blog/s3-clones-in-the…
Danielle Aminov retweeted
This might be unfair nitpicking, but I'm bothered by the fact that no one involved in writing / reviewing Anthropic's blogpost thought to use the well-established technical term for the technique described in this paragraph (dependency confusion).
I’ve spent more time than I’d like thinking about supply chain attacks lately ⛓️💭
At some point, the only reasonable thing to do was sit down with @merav_br and compare notes on the attacks that reshaped the security landscape
Watch the full episode: youtu.be/fFDKDLRQneQ?si=T9RO…
Danielle Aminov retweeted
@AminovDanielle and i did the one thing harder than dealing with supply chain attacks - which is try to be cool on camera while talking about them
Check it out! 👩🏻🐰👩🏽💅
🏆 Introducing Wiz Brackets, where the biggest cyber threats go head-to-head. 🥊
Our threat researchers @AminovDanielle & @merav_br break down which attack wins on complexity, impact, novelty & responder pain
Watch the full episode 🎬
youtu.be/fFDKDLRQneQ
Danielle Aminov retweeted
🏆 Introducing Wiz Brackets, where the biggest cyber threats go head-to-head. 🥊
Our threat researchers @AminovDanielle & @merav_br break down which attack wins on complexity, impact, novelty & responder pain
Watch the full episode 🎬
youtu.be/fFDKDLRQneQ
Danielle Aminov retweeted
MCP servers can unintentionally expose sensitive data or allow anonymous users to perform destructive actions on internal databases - we scanned a wide variety of servers and found plenty of evidence that this risk isn't theoretical:
wiz.io/blog/the-risk-hiding-…
Danielle Aminov retweeted
We (+@liormama) gained full access to EVERY database on Azure's flagship DB service 🤯
And all we needed was a single key 🔑
This is the story of #CosmosEscape 🧵👇
Danielle Aminov retweeted
Sharing our observations so far in terms of wp2shell exploitation in the wild, by @shahardorf @GiliTikochinki
wiz.io/blog/wp2shell-cve-202…
Danielle Aminov retweeted
Way back in December 2025 @AmitaiCo & I hyped GitHub as a threat intelligence source on the @BlackHatEvents Europe stage.
I think we were immediately vindicated!
Despite all that has happened in the GitHub threat landscape since, it's still a masterclass in GH TI: youtube.com/watch?v=JZUV8dY7…
Danielle Aminov retweeted
🎙️ NEW PODCAST: AI just uncovered a #Linux bug hiding since 2017 👀
Eden & @AmitaiCo sit with @tjbecker & Jacob Newman from @xint_official to unpack CopyFail, the privilege escalation flaw their autonomous AI agents discovered affecting Linux machines worldwide.
Jenkins.. still building code, leaking secrets, and keeping security teams busy 😈
My new research on the Jenkins threat landscape 🔍☁️
Exposed instances, deprecated plugins, CI/CD attack paths… and based on TeamPCP’s recent activity, I think they read it too 👀 wiz.io/blog/jenkins-threat-r…
Danielle Aminov retweeted
🚨 Meet "Dirty Frag": a new Linux kernel privilege escalation, fresh off the heels of Copy Fail.
Wiz Research is tracking CVE-2026-43284 and CVE-2026-43500 (also known as Copy Fail 2), discovered by Hyunwoo Kim (@v4bel). No official patches are out yet, and a public PoC already exists.
🔑 The technical bit:
A vulnerability chain in the ESP (IPsec) and RxRPC kernel subsystems, with two deterministic page-cache write primitives in the same spirit as Dirty Pipe. Ubuntu, RHEL 8/9/10, AlmaLinux, Fedora, openSUSE, and more are all affected.
🛡️ Slightly less risky for containers:
Exploitation usually requires CAP_NET_ADMIN, so hardened Kubernetes setups with default seccomp profiles are at lower risk. VMs and less restricted environments should still take this seriously.
🔧 What to do now:
Until patches drop, you can temporarily disable the vulnerable kernel modules (esp4, esp6, rxrpc). Full mitigation and detection guidance in the blog.
Wiz customers: pre-built queries and a live advisory are already in the Threat Intel Center. We'll keep updating both as more info comes to light.
Full research from Merav Bar and @ramimacisabird: wiz.io/blog/dirty-frag-linux…
