Wiz’s Most-Read 2025 Research Highlights Supply-Chain Attacks, AI Exposure and Critical Vulnerabilities
Summary
Wiz’s 2025 research roundup highlights supply-chain campaigns, exposed AI-related data and critical infrastructure vulnerabilities, including attacks that spread through npm and GitHub and flaws affecting React, Ingress NGINX and Redis.
Key points
- Wiz says supply-chain attacks accounted for more than half of its most-read investigations in 2025, with campaigns targeting CI/CD systems, package registries and build pipelines.
- An exposed DeepSeek ClickHouse database contained more than a million lines of logs, including chat history, secret keys and backend details, according to Wiz Research.
- Wiz reported that a Shai-Hulud-linked npm campaign spread to more than 25,000 malicious repos across about 500 GitHub users.
- Wiz described malicious npm packages and GitHub Actions that harvested secrets, tokens, SSH keys and other sensitive developer assets.
- The roundup covers critical vulnerabilities in React Server Components, Ingress NGINX and Redis, including unauthenticated remote code execution flaws.
- Wiz said malicious npm code in the debug/chalk incident reached one in 10 cloud environments during the two-hour period it was available.
Article Details
- Topic
- Wiz Research's most-read cybersecurity findings of 2025, covering software supply-chain attacks, exposed AI data, and critical infrastructure vulnerabilities.
CVE
CVE-2025-1097Wiz Research discovered CVE-2025-1097, CVE-2025-1098, CVE-2025-24514 and CVE-2025-1974, a series of unauthenticated RCE vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed #IngressNightmare. ExploitationCVE-2025-1098Wiz Research discovered CVE-2025-1097, CVE-2025-1098, CVE-2025-24514 and CVE-2025-1974, a series of unauthenticated RCE vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed #IngressNightmare. ExploitationCVE-2025-19744. IngressNightmare: CVE-2025-1974 - 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINXCVE-2025-24514Wiz Research discovered CVE-2025-1097, CVE-2025-1098, CVE-2025-24514 and CVE-2025-1974, a series of unauthenticated RCE vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed #IngressNightmare. ExploitationCVE-2025-498446. RediShell: Critical Remote Code Execution Vulnerability (CVE-2025-49844) in Redis, 10 CVSS scoreCVE-2025-551823. React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability
Malware
Products
ClickHouseWiz Research identified a publicly accessible ClickHouse database belonging to DeepSeek, which allowed full control over database operations, including the ability to access internal data. The exposure included over aKubernetes ingress-nginxCVE-2025-24514 and CVE-2025-1974, a series of unauthenticated RCE vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed #IngressNightmare. Exploitation of these vulnerabilities could’ve led toNext.js(RSC) "Flight" protocol, affecting the React 19 ecosystem and frameworks that implement it, most notably Next.js. Assigned CVE-2025-55182, this flaw allowed for unauthenticated remote code execution (RCE) on the serverNxMultiple malicious versions of the widely used Nx build system package were published to the npm registry. These versions contained a post-installation malware script designed to harvest sensitive developer assets,React3. React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React VulnerabilityRedis6. RediShell: Critical Remote Code Execution Vulnerability (CVE-2025-49844) in Redis, 10 CVSS scorereviewdog/action-setup9. New GitHub Action supply chain attack: reviewdog/action-setuptj-actions/changed-files8. GitHub Action tj-actions/changed-files supply chain attack: everything you need to know