Top all-time · #278
wiz.io
Company blog · wiz.io/blogsecurityai
wiz.io is the company blog at wiz.io, writing about security and ai. Since 2021, 181 different Hacker News readers have linked it 248 times, most often “ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough”. It is still writing: the last post was on 2026-11-02, and you can follow it by feed.
Rarely recommended · 0 of 40 sampled comments recommend it?
Why HN links it
HN readers link Wiz's security research blog for technical write-ups of cloud and supply-chain vulnerabilities, such as Azure cross-tenant flaws, the PHP2Shell RCE, and npm malware campaigns.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Wiz connects code, cloud, and runtime into one agentic cybersecurity platform. Prevent risk, detect threats, and start secure – across every cloud and AI layer.
Most-linked posts?
- ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough12 people · 13 mentions · first linked 2021-11-11
- PHP2Shell: AI uncovers critical RCE in PHP11 people · 12 mentions · first linked 2026-10-21
- Compromised Microsoft Key: More Impactful Than We Thought10 people · 10 mentions · first linked 2023-07-21
- ChaosDB: We hacked thousands of Azure customers’ databases8 people · 9 mentions · first linked 2021-08-27
- $100M ARR in 18 months: Wiz becomes the fastest-growing software company ever7 people · 8 mentions · first linked 2022-08-10
- Hacking Moltbook: The AI Social Network Any Human Can Control6 people · 7 mentions · first linked 2026-02-02
- Exposed DeepSeek database leaking sensitive information, including chat history6 people · 7 mentions · first linked 2025-01-29
- Bing.com results could have been manipulated due to a simple misconfiguration5 people · 5 mentions · first linked 2023-03-29
- GitHub RCE Vulnerability: CVE-2026-3854 Breakdown5 people · 5 mentions · first linked 2026-04-28
- GitHub Action tj-actions/changed-files supply chain attack4 people · 5 mentions · first linked 2025-03-16
What Hacker News says?
If anyone feels like disagreeing about Azure, here's a comment of mine from a few months ago: A random selection of serious security incidents from Azure: just from Wiz from the past 2-3 years, and of course they aren't the only ones: https://www.wiz.io/blog/secret-agent-exposes-azure-customers... https://www.wiz.io/blog/storm-0558-compromised-microsoft-key... https://www.wiz.io/blog/azure-active-directory-bing-misc…
Comment linking /blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers
on “CrowdStrike Update: Windows Bluescreen and Boot Loops”Submitted Exposed DeepSeek database leaking sensitive information, including chat history as a story · 707 points
HN discussion> $100mm for a Series A is unheard of in software. Peak 2020: https://www.wiz.io/blog/wiz-comes-out-of-stealth-with-100m-s...
Comment linking /blog/wiz-comes-out-of-stealth-with-100m-series-a-funding-to-reinvent-cloud-security
on “Silicon Valley's best kept secret: Founder liquidity”Submitted PHP2Shell: AI uncovers critical RCE in PHP as a story · 455 points
HN discussionThere's also this writeup: https://www.wiz.io/blog/php2shell-php-rce It seems to have a few more technical details.
Comment linking /blog/php2shell-php-rce
on “Security advisory: Critical remote code execution vulnerabilities, update now”Submitted "Secret" Agent Exposes Azure Customers to Unauthorized Code Execution as a story · 296 points
HN discussionMozilla and Google provide an alternative called gemmafile which gives you an airgapped version of Gemini (which Google calls Gemma) that runs locally in a single file without any dependencies. https://huggingface.co/jartine/gemma-2-27b-it-llamafile It's been deployed into production by 32% of organizations: https://www.wiz.io/reports/the-state-of-ai-in-the-cloud-2025
Comment linking /reports/the-state-of-ai-in-the-cloud-2025
on “Gemini CLI”Submitted SAPwned: SAP AI vulnerabilities expose customers' cloud environments and privat as a story · 254 points
HN discussionInteresting. According to https://www.wiz.io/blog/s1ngularity-supply-chain-attack the initial entry point was a "flawed GitHub Actions workflow that allowed code injection through unsanitized pull request titles" — which was detected and mitigated on August 29. That was more than ten days ago , and yet major packages were compromised yesterday. How?
Comment linking /blog/s1ngularity-supply-chain-attack
on “NPM debug and chalk packages compromised”Submitted How to harden GitHub Actions as a story · 218 points
HN discussionLooks like a co-ordinated disclosure between Wiz, Calif and OpenAI: https://www.php2shell.com/ https://www.wiz.io/blog/php2shell-php-rce https://calif.io/php2shell/ https://openai.com/index/coordinated-disclosure-of-critical-... (not yet live) https://thephp.foundation/blog/2026/10/21/todays-php-securit... (not yet live)
Comment linking /blog/php2shell-php-rce
on “PHP 8.2.35”Submitted PHP2Shell: Exploitation attempts and remediation trends as a story · 192 points
HN discussionWe're monitoring this activity as well and updating the list of affected packages here: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-... Currently reverse engineering the malicious payload and will share our findings within the next few hours.
Comment linking /blog/shai-hulud-2-0-ongoing-supply-chain-attack
on “Shai-Hulud Returns: Over 300 NPM Packages Infected”Submitted RediShell: Critical remote code execution vulnerability in Redis as a story · 143 points
HN discussion(I'm assuming you read my technical article about the problem) If you take a look at the pull requests in e.g. the changed-files repo, it's pretty obvious what happened. You can still see some of the malformed git branch names and other things that the bots tried out. There were lots of "fixes" that just changed environment variable names from PAT_TOKEN to GITHUB_TOKEN and similar things afterwards, which kind of ju…
Comment linking /blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
on “The Pain That Is GitHub Actions”Submitted Critical RCE Vulnerabilities in React and Next.js as a story · 134 points
HN discussionYes, it is definitely dangerous, like any other code running next to your stuff. The thing you remember is probably this: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-ch... and a larger description: https://www.wiz.io/blog/github-action-tj-actions-changed-fil... I will be stunned if this doesn't become a more popular attack vector over the next few years. Lots of valuable stuff sits in github, and they'…
Comment linking /blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
on “The Pain That Is GitHub Actions”Submitted 38TB of data accidentally exposed by Microsoft AI researchers as a story · 125 points
HN discussionWiz (subsidiary of google) claims to have a working exploit: https://www.wiz.io/blog/php2shell-php-rce . Calif has as well: https://calif.io/php2shell/ . Calif even posted a video demonstrating the exploit (subsequently removed)
Comment linking /blog/php2shell-php-rce
on “There isn't an easy exploit for this PHP vulnerability”Submitted Critical vulnerability in AI coding platform Base44 allowing unauthorized access as a story · 122 points
HN discussionTwo things can be true: it's a real, exploitable CVE 10, and it's hard enough to construct that you need a good harness + verification process to keep your LLM from cheating. So, the exploit may not be easy to construct , but it doesn't actually require the artificial settings that the OP implied. > What we demonstrated > Pre-authentication RCE on WordPress, Drupal and Joomla [0] https://www.wiz.io/blog/php2shell-ph…
Comment linking /blog/php2shell-php-rce
on “There isn't an easy exploit for this PHP vulnerability”Submitted ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough as a story · 116 points
HN discussionWiz: "These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it"[1] Calif: "the available exploitation paths depend on the PHP version and SAPI but are always exploitable under default configurations" ... "This results in RCE against arbitrary PHP scripts on Apache mod_php and PHP >= 5.4.0."[2] PHP Foundation: "full re…
Comment linking /blog/php2shell-php-rce
on “There isn't an easy exploit for this PHP vulnerability”Submitted Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX as a story · 79 points
HN discussionThere are multiple write-ups on how the vulnerability works. The Calif one is the most detailed. Also, no one used Claude. There's a whole world of information out there when you read the original sources instead of social media distortions. https://calif.io/php2shell/ https://www.wiz.io/blog/php2shell-php-rce
Comment linking /blog/php2shell-php-rce
on “There isn't an easy exploit for this PHP vulnerability”Submitted A cross-account database vulnerability in Azure PostgreSQL as a story · 60 points
HN discussionDocker images from Wordpress, joomla, and drupal were all exploitable. https://www.wiz.io/blog/php2shell-php-rce
Comment linking /blog/php2shell-php-rce
on “There isn't an easy exploit for this PHP vulnerability”Submitted Gheist campaign plants secret-dumping workflows using stolen GitHub tokens as a story · 47 points
HN discussionWhat kind of pisses me off was that there were kind of two sides of the continuum. You've got the detailed technical writeup on one end in the patches themselves, and on the other end you've essentially got the AI and security companies both together (php2shell) and independently with their highly polished microsites and blog posts with attractive infographics and stylized pitch deck looking images. Every publicatio…
Comment linking /blog/php2shell-php-rce
on “There isn't an easy exploit for this PHP vulnerability”Submitted ChaosDB: We hacked thousands of Azure customers’ databases as a story · 46 points
HN discussion
