Danielle Aminov

Threat researcher @wiz_io

[Danielle Aminov @AminovDanielle]

We have been reverse engineering the XZ Utils backdoor and are sharing some initial findings: we've identified multiple hooking options to adapt to different environments, and a hardcoded fake public key that can appear in verbose SSH logs depending on attacker-controlled flags.

[Wiz @wiz_io]

🎙️ NEW PODCAST: AI just uncovered a #Linux bug hiding since 2017 👀

Eden & @AmitaiCo sit with @tjbecker & Jacob Newman from @xint_official to unpack CopyFail, the privilege escalation flaw their autonomous AI agents discovered affecting Linux machines worldwide.

[Danielle Aminov @AminovDanielle]

Jenkins.. still building code, leaking secrets, and keeping security teams busy 😈

[Merav @merav_br]

My new research on the Jenkins threat landscape 🔍☁️
Exposed instances, deprecated plugins, CI/CD attack paths… and based on TeamPCP’s recent activity, I think they read it too 👀 https://t.co/POfAjCQRt9

[Wiz @wiz_io]

🚨 Meet "Dirty Frag": a new Linux kernel privilege escalation, fresh off the heels of Copy Fail.

Wiz Research is tracking CVE-2026-43284 and CVE-2026-43500 (also known as Copy Fail 2), discovered by Hyunwoo Kim (@v4bel). No official patches are out yet, and a public PoC already exists.

🔑 The technical bit:
A vulnerability chain in the ESP (IPsec) and RxRPC kernel subsystems, with two deterministic page-cache write primitives in the same spirit as Dirty Pipe. Ubuntu, RHEL 8/9/10, AlmaLinux, Fedora, openSUSE, and more are all affected.

🛡️ Slightly less risky for containers:
Exploitation usually requires CAP_NET_ADMIN, so hardened Kubernetes setups with default seccomp profiles are at lower risk. VMs and less restricted environments should still take this seriously.

🔧 What to do now:
Until patches drop, you can temporarily disable the vulnerable kernel modules (esp4, esp6, rxrpc). Full mitigation and detection guidance in the blog.

Wiz customers: pre-built queries and a live advisory are already in the Threat Intel Center. We'll keep updating both as more info comes to light.

Full research from Merav Bar and @ramimacisabird: https://t.co/kLA2OWQ9F2

[Amitai Cohen @AmitaiCo]

npm package "intercom-client" version 7.0.4 is compromised (still available to download as of now), likely related to Mini Shai Hulud campaign by TeamPCP based on shared characteristics

[Wiz @wiz_io]

🎉 IT'S OFFICIAL: @wiz_io joins @Google to secure the AI era.

This is a massive moment for our customers and our team.

Thank you to every customer, partner, and Wizard who made this moment possible 💙

We can't wait to share what's next.
https://t.co/jWqlN34Qcs

[sapir federovsky @sapirxfed]

@shahardorf & I found a phishing campaign abusing oauth applications in Entra in more than 50 organizations! And i promise you that in this blog we explain how you can do it too! And provide all the IOCs 🤭 It's one of these blogs i would enjoy reading!
https://t.co/2Eh1nkc0nN

[Danielle Aminov @AminovDanielle]

I had the pleasure of speaking at @DistrictCon 🪩 in Washington, DC last weekend. It was my second time speaking at the conference - this time about another common misconfiguration in the cloud that should make you think twice. Power outage last year, snowstorm this year ❄️ once again, the hacker community showed up strong. What a community! great energy and brilliant people 🙌

[Nagli @galnagli]

Introducing my Bug Bounty Masterclass. 100% free.

I've made $2,000,000+ finding security bugs. I spent the last year turning my methodology into a complete blueprint.

4 hours of video - foundations, reconnaissance, web proxies, hands-on challenges, and certification.

Finish it in a weekend and start hacking real-world applications 🐞

[Yuval Avrahami @yuvalavra]

We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯

How did we do it? Just two missing characters was all it took.

This is the story of #CodeBreach 🧵👇

[Danielle Aminov @AminovDanielle]

Excited to be returning to @DistrictCon for round two this month!
Back on stage again, presenting: Auths Gone Wild – When authenticated means anyone 🪩
Looking forward to another epic DistrictCon and great conversations around auth gone wrong 🔓

[Amitai Cohen @AmitaiCo]

Wiz Research has published a new simple Nuclei template for reliably detecting MongoBleed (CVE-2025-14847). We've also updated our blogpost with additional guidance on determining exploitability depending on how you're using MongoDB:

[Amitai Cohen @AmitaiCo]

Here's our new blogpost with a technical deepdive into exploitation we're observing in the wild of CVE-2025-55182 (aka react2shell):
https://t.co/jBvMgTqjEO

[Wiz @wiz_io]

🚨 React2Shell (CVE‑2025‑55182) in‑the‑wild exploitation & deep‑dive analysis. Critical RCE across React 19, Next.js & all RSC frameworks. Patch now.
https://t.co/SRS7e2PRZ4

[Danielle Aminov @AminovDanielle]

For the latest developments on React2Shell 👉https://t.co/cMvEbTeWLq

[Danielle Aminov @AminovDanielle]

With all the talk about the Next.js PoC, many people missed that the React2Shell vulnerability (CVE-2025-55182) affects the underlying RSC implementation itself. This means other popular frameworks that rely on RSC are also vulnerable. We are still analyzing the impact and ease of exploitation across additional platforms. For example, the commonly used Vite RSC plugin, when running with its default configuration, is also vulnerable with only minor modifications to the existing PoC. Patch your environments as soon as possible 🏃‍♀️

[Danielle Aminov @AminovDanielle]

We were analyzing the new RSC vulnerability and its impact. RSC is a React feature, but most apps use it through Next.js, which bundles RSC widely. So it will likely surface most often as Next.js CVE-2025-66478. Patch snippet below 🧐 Initial analysis: https://t.co/cMvEbTeWLq

[Rami McCarthy @ramimacisabird]

🪱sharing more on sha1-hulud w/@sshaybbc

* 2 packages == ~60% of infections
* 400k unique secrets in truffleSecrets.jsons, only 2.5% verified, & the majority of those short lived JWTs for GitHub Actions!
* 3/4 of impacted workloads were CI/CD, 1/4 were users
🔗below

[Wiz @wiz_io]

WIZ ASM IS HERE!💥
Discover, validate & prioritize all your exposures cloud, AI, SaaS & on-prem. Context-driven ASM powered by Wiz Security Graph. Eliminate exploitable risk everywhere!

Ready to see Wiz ASM in action? 🥳 https://t.co/m6htGHYo3P

[Scott Piper @0xdabbad00]

I put together a service dependency diagram based on what has been mentioned in today's AWS outage, along with Monday's, and one from Nov 25, 2020 with color coding based on which outage mentioned the dependency.

[Rami McCarthy @ramimacisabird]

Finally disclosing the critical supply chain attack I've spent the last 6 months preventing:

🧵