cyber.hendryadrian.com
Security News · wiz.io

Wiz Links Validated Runtime Vulnerabilities to Source-Code Remediation

· Original article ↗

Summary

Wiz says its Security Graph now connects vulnerabilities validated by its Attack Surface Scanner to code findings, traces them from source to runtime, and lets users open remediation pull requests.

Key points

  • Wiz says its Attack Surface Scanner safely probes internet-exposed applications and marks vulnerabilities as validated when exploitation is confirmed.
  • The Security Graph correlates validated runtime risks with findings from Wiz Code’s SCA scanner and identifies risks with code remediation paths.
  • A Code-to-Cloud Pipeline traces issues across source, build, artifact, and runtime stages without manual tagging, custom CI configuration, or agents, according to Wiz.
  • Users can review a recommended fix and open a pull request from a validated finding; Wiz’s Mika AI may suggest additional mitigations.
  • Wiz groups runtime findings by their source-mapped dependency to support remediation of a shared root cause across multiple services.
  • The capability is available now to Wiz customers. The article also reports that React2Shell affected nearly 40% of cloud environments and was exploited within hours.

Article Details

Event Type
Wiz announced a capability connecting validated runtime vulnerabilities to their source code and remediation workflows.
Impact
Wiz says the capability correlates externally validated, exploitable runtime risks with code findings and supports remediation through pull requests. The article also reports that React2Shell affected nearly 40% of cloud environments and was exploited in the wild within hours.

Vendors

WizWiz closes that loop. We’ve extended the Wiz Security Graph to connect validated runtime vulnerabilities from the Wiz Attack Surface Scanner (ASM) directly back to their source code. This allows teams to fix the most

Products

Code-to-Cloud PipelineEnd the Guesswork: Full Traceability with the Code-to-Cloud PipelineIssues ExpertTeams can also interact with Mika AI, which pulls in the Issues Expert agent to provide deeper guidance. Beyond a simple upgrade, the agent may recommend additional mitigations, such as middleware protections orMika AITeams can also interact with Mika AI, which pulls in the Issues Expert agent to provide deeper guidance. Beyond a simple upgrade, the agent may recommend additional mitigations, such as middleware protections orNext.jsFive years after Log4Shell, the industry faced another critical RCE, this time in the React and Next.js ecosystems. Nearly 40% of cloud environments were affected by React2Shell, and exploitation was observed in thePosture IssuesWiz addresses this with Posture Issues. These are equivalent to fix campaigns, designed for medium- and long-term remediation.ReactFive years after Log4Shell, the industry faced another critical RCE, this time in the React and Next.js ecosystems. Nearly 40% of cloud environments were affected by React2Shell, and exploitation was observed in theWiz Attack Surface Management (ASM)We’ve extended the Wiz Security Graph to connect validated runtime vulnerabilities from the Wiz Attack Surface Scanner (ASM) directly back to their source code. This allows teams to fix the most critical risksWiz CodeSecurity Graph immediately correlates the signal with the corresponding finding in the code, raised by Wiz Code’s SCA scanner.Wiz Security GraphWiz closes that loop. We’ve extended the Wiz Security Graph to connect validated runtime vulnerabilities from the Wiz Attack Surface Scanner (ASM) directly back to their source code. This allows teams to fix the most

Related Articles