Wiz Research reported on July 8 that six AI coding assistants can be tricked into writing an attacker's SSH key into ~/.ssh/authorized_keys while approval dialogs show a different filename. On July 16…
Wiz Research disclosed CosmosEscape, a chained vulnerability in Azure Cosmos DB's Gremlin API that allowed a researcher to execute arbitrary code on the shared Gateway and retrieve the primary key for…
Wiz Research has built Atlas, an autonomous AI system for vulnerability research that ranks #1 on the CyberGym benchmark with a 90.9% success rate and has uncovered more than 200 previously unknown vu…
Ollama has shipped three remote-code-execution vulnerabilities in three years, all at the model-loading boundary. The most recent class, an Out-Of-Bounds Write in MLLAMA model metadata parsing affecti…
Amazon Q Developer's VS Code extension automatically executed MCP server configurations from workspace files without user consent, exposing AWS credentials. Wiz Research disclosed CVE-2026-12957 (CVSS…
A vulnerability in Amazon Q Developer, tracked as CVE-2026-12957 with a CVSS score of 8.5, allowed attackers to steal AWS credentials by tricking developers into opening a malicious repository. The fl…
A high-severity vulnerability in Amazon Q Developer, tracked as CVE-2026-12957 with a CVSS score of 8.5, allowed malicious Git repositories to execute arbitrary commands and exfiltrate AWS credentials…
A high-severity flaw in Amazon Q Developer allowed malicious code repositories to silently execute commands on developers' machines and steal AWS credentials. Wiz Research discovered the vulnerability…
A high-severity vulnerability in Amazon Q Developer, tracked as CVE-2026-12957 with a CVSS score of 8.5, allowed malicious repositories to execute arbitrary code and exfiltrate cloud credentials when …