PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Under the Radar: Exploring Spring Boot Actuator Misconfigurations

wiz.io | blog | #rce | #cloud-security | #java | #misconfiguration | #threat-research | #spring-boot
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Threat Research examines Spring Boot Actuator misconfigurations that leak credentials and API keys—and can enable RCE—found in one in four environments with exposed endpoints.
Published
Collected

Related coverage

vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
blog · wiz.io
Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense
Wiz's contribution to the 2026 Verizon DBIR: exploitation is now the top initial access vector (31% of breaches) and only 26% of known exploited vulnerabilities were remediated.
blog · wiz.io
Cloud Threats Retrospective 2026: What AI Changed (and What It Didn’t)
Wiz's Cloud Threats Retrospective: 80% of 2025 intrusions began with known weaknesses — vulnerabilities, exposed secrets, misconfigurations — while AI expanded the surface and sped up attackers.
blog · wiz.io
Introducing HoneyBee: How We Automate Honeypot Deployment for Threat Research
Wiz introduces HoneyBee, an open-source tool that auto-generates intentionally misconfigured Docker deployments, with Nuclei validation templates, so researchers can deploy realistic honeypots safely.
blog · wiz.io
The emerging use of malware invoking AI
Wiz reviews malware that invokes AI directly — LameHug's HuggingFace recon prompts, the Amazon Q extension compromise, s1ngularity's AI-CLI abuse and PromptLock — moving prompts into payloads.
Back