PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Code to Cloud Attacks: From Github PAT to Cloud Control Plane

wiz.io | blog | #cloud | #supply-chain | #cloud-security | #secrets | #github | #ci-cd | #pat | #wiz-cirt
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz CIRT reports GitHub PAT attacks escalating to cloud control-plane access: attackers enumerate Action secret names via unlogged code searches, then plant workflows that harvest CSP credentials.
Published
Collected

Related coverage

blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
2025 State of Code Security: Key Trends and Risks
Wiz's 2025 State of Code Security report: 35% of GitHub repos are public, 61% of organizations have cloud secrets exposed in public repos, and self-hosted CI/CD runners raise lateral-movement risk.
blog · metabase.com
More, Better, Faster: How we automate Metabase releases
How we went from a manual Metabase release checklist to fully automated daily patch releases with GitHub Actions, reused test builds, and a three-click release UI
blog · vercel.com
Mitigating Denial of Wallet risks with Vercel
Protect against Denial of Wallet (DoW) attacks with Vercel. DoW exploits cloud scalability to inflate costs. Vercel provides solutions like budget alerts, spend limits, and anomaly detection to safeguard workloads and maintain financial stability.
blog · vercel.com
Introducing Vercel Firewall and Vercel Secure Compute
Vercel Secure Compute and Vercel Firewall for enhanced protection of your applications on the frontend cloud
research · wiz.io
Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks
Wiz scanned the Forbes AI 50 and found 65% of leading private AI companies had verified secret leaks on GitHub — API keys and tokens buried in deleted forks and gists that standard scanners miss.
Back