Shir

Want to learn how to hack AI chatbots? 🤖

Check out our new challenge on LLM jailbreaks. Engineer the right prompts and make the AI follow your commands 😈

No previous experience needed. High scorers get on the leaderboard.

Check it out -> promptairlines.com

🚨Following our recent vulnerability disclosure with @hugging face and @replicate, today we (@wiz_io) reveal a 3rd critical issue in @SAP AI Core. This vulnerabilities could allow potential attackers to takeover the entire service, accessing customers' AI data and creds 🧵👇

Seeing my nickname in this image makes me feel old

We at @wiz_io have been researching AI service providers and found a concerning pattern that could let attackers access other users' prompts, models, and datasets.

Why is this happening? 🧵

What a quick response from the best team

😂

We've started a Kubernetes Capture The Flag challenge. It's all about AWS EKS, five different challenges, showing common mistakes in k8s environments that we found in our research. Give it a try! #EKSClusterGames
eksclustergames.com

Ping me if you'd like to chat over iced tea during Def Con and Black Hat 🧋

My friends at Seal Security (@itamar_sher, @levp92, @thewiseoak_) just released an open-source inventory of hotfixes for common library vulnerabilities.

It enables patching libraries without requiring a full-version update
github.com/seal-community…

Classic open-source modification vulnerability: Due to Ubuntu kernel modification, vulnerable flow that was fixed in Linux remained open in Ubuntu

Today we launch the Big IAM Challenge🍾
An open internet competition to test your AWS IAM hacking skills.

We've crafted 6⃣ challenges, from easy to difficult, based on real attack scenarios we've witnessed in our cloud security research. give it a try🔻wiz.io/blog/the-big-i…

I had the pleasure of working with @notdurson on multiple occasions, and I cannot speak highly enough of his professionalism and dedication. Any team would be lucky to have him.

New Alibaba Cloud vulnerability
We found RCE, container escape, K8s lateral movement & supply chain attacks allowing compromise of the entire service & customer data. Findings have far-reaching implications for any k8s or containerized envs. Read it here 👉wiz.io/blog/brokenses…

Continuing the #BingBang thread, many have asked how we found the vulnerable Bing Trivia endpoint.

Let me share our unique Azure Active Directory cloud reconnaissance technique to find misconfigured authentication prompts🧵

Fantastic research from @kfosaaen @NetSPI

@hillai from our team investigated Azure Active Directory misconfigurations and successfully bypassed authentications for many applications, including the Bing.com management panel which allowed him to manipulate Bing's search results 🤯

Vulnerability only affects SMB servers using the experimental ksmbd module (Intro'd in Linux 5.15). If your SMB server uses Samba, you're safe. If it uses ksmbd, an attacker with read access could leak your server's memory (similar to Heartbleed). zerodayinitiative.com/advisories/ZDI…

Great TLDR of our latest cloud isolation research

Today we're publicly disclosing #HellsKeychain. We proved that by using a chain of vulnerabilities, it's possible to gain access to an internal CI/CD server & carry out a supply-chain attack against IBM Cloud's managed DB service>>

Vulnerability full disclosure - New Oracle cloud vulnerability allowed users to access the virtual disks of other Oracle customers >>