New Railway says the attacker in its October breach used abliterated models and an ARTEX-like harness, and puts unauthorised AI spend at about $740,000
Railway's incident report says the attacker "exploited a previously unknown vulnerability in our build infrastructure to partially escape filesystem isolation" at 07:28 UTC on October 20, obtaining a build-server credential, and gained a second route at 03:26 UTC on October 21 through "an erroneously defined OIDC binding configuration". Railway puts the reach at "at most, 1.85% (~100,000) of workspaces", says stored histories of 353 builds were read and linked-account tokens of 1,852 users decrypted, among them bring-your-own AI provider keys and GitHub OAuth tokens, and estimates about $740,000 in unauthorised spend. It says the attacker was "specifically targeting AI provider credentials" and used "abliterated models with no safeguards" with "a harness similar to ARTEX, according to Wiz". Railway does not independently attribute the incident and has reported it to the FBI's IC3.
Wiz says at least nine AI developer platforms disclosed incidents in October, with attackers hunting the environment variables that grant AI access
Wiz says at least nine AI developer platforms disclosed incidents in October, and later notes through November 3 add three more publicly reported incidents (Brev, Trigger.dev and Chainstack). It says all public reports describe targeted exploitation "explicitly hunting stored environment variables, with a focus on those granting AI access"; in two cases it traced approximately 800,000 and 1.7 million Amazon Bedrock calls made with stolen keys. Wiz finds no single vulnerability or dependency linking the attacks and does not attribute them to one actor.
LiteLLM says attackers used three engineers' GitHub credentials to ship a credential stealer as version 1.107.0
LiteLLM says malicious actions were taken through three engineers' GitHub accounts to force-push and publish version 1.107.0 to PyPI, Docker Hub and GHCR on October 21, and that all tokens involved in the attack have been revoked. Wiz reports the package took about 49,000 downloads per ClickPy data, was uploaded to PyPI at 11:39 UTC and quarantined at 13:20, and that stolen AWS instance role credentials were tested from two addresses about four and a half hours after exfiltration using sts:GetCallerIdentity followed by Bedrock model-listing calls, a pattern Wiz calls consistent with LLMjacking. LiteLLM says it suspects the attacker obtained GitHub CLI OAuth tokens from the logs of an internet-exposed internal deployment, noting that "Claude Code will embed a user's GitHub CLI OAuth token into a response body", and has not confirmed how that deployment was reached.
Wiz says AI models helped it find two remote-code-execution flaws in nearly every PHP release of the last decade
Wiz Research reports finding two flaws it says are grouped under CVE-2026-109618 and CVE-2026-109619 with "severity reaching CVSS 9.2", describing them as memory-safety issues stemming from bugs in how PHP handles fatal errors, and says Gemini 4 Argon made an "invaluable contribution" to finding the vulnerability, exploit development, attack detection and validation of the patch, alongside GPT-5.6 Sol and its own Wiz Atlas tool. Wiz dates its first discovery to August 19, confirmation of unauthenticated code execution against Drupal and WordPress to August 20 and 21, and its report to the PHP security team to August 24; patched releases and public disclosure followed on October 21, and Wiz says that with frontier models and the right tools "a single researcher completed in a week what previously would have taken a world-class team months of work."
Google and Wiz launch Scan for Good, running AI vulnerability scans for public services and critical infrastructure with a human validating every finding
The Register reports that Google and Wiz launched Scan for Good, which uses Google's Gemini 3.8 Flash Cyber and Wiz's Red Agent to look for exposures in the publicly facing websites, APIs and applications of public services, critical infrastructure and nonprofits, when organisations apply for an assessment or under bug bounty and disclosure policies, with every potential finding reviewed and validated by a human; Wiz said CISA provided guidance and that the programme had been active for several months before the launch.
Google opens Fairwind, a vetted-access program for its cyber model and CodeMender
Fairwind limits access to Gemini 3.8 Flash Cyber and CodeMender to government and national cyber authorities, critical infrastructure operators in healthcare, telecommunications, energy and financial services, and core technology platforms, with use confined to internal cybersecurity, incident response and penetration testing staff and multi-factor authentication required. Google states more than 650 participating partners globally and names Armadin, CrowdStrike, Palo Alto Networks, Snowflake and Wiz among them.
AI-agent firewall startup AIR Security launches with $50 million from Sequoia and Greenoaks
AIR Security came out of stealth with $50 million raised across two rounds — $10 million led by Sequoia Capital and $40 million led by Greenoaks Capital Partners, with Swish Ventures and Netz Capital also participating — for an inline firewall that screens the instructions, tools and data an AI agent reaches before it acts and maintains a vetted marketplace of add-ons. The company says its own scanning found more than 17,800 public AI add-ons with 6.7 million installations drawing instructions from untrusted external sources, and add-ons impersonating Anthropic and OpenAI that could execute arbitrary code; it reports more than 20 customers, about a quarter of them large enterprises. Angel investors named include Wiz co-founder Yinon Costica and former White House deputy national security adviser for cyber Anne Neuberger.
Wiz honeypots record attackers exploiting MCP servers and self-hosted AI stacks
Over a 90-day honeypot study across self-hosted AI services, Wiz Threat Research observed three attack patterns against AI infrastructure: exploitation of Model Context Protocol servers, including an authentication bypass in LiteLLM's MCP gateway that accepted any bearer token and a command-injection flaw used to drop cryptominers; blind indirect prompt injection against LangChain, Flowise, OpenWebUI and Node-RED deployments, confirmed through out-of-band DNS callbacks; and AI-native post-exploitation in which attackers read a compromised LiteLLM process's Python module state in memory to steal master keys rather than searching files.
Poisoned Rust crates ran a backdoor at compile time, on infrastructure Wiz ties to North Korean campaigns
Wiz reports malicious versions of arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9 on crates.io pulling a typosquatted proc-macro1 dependency whose build script downloads and executes a remote binary, so “building an affected project was sufficient to execute the payload.” It says arrayref “can be found in over 35% of all environments” and in three-quarters of environments where Rust is present, and ties the campaign to North Korean activity through a shared /49890878 beacon endpoint used in the Mastra campaign Microsoft attributed to Sapphire Sleet, a shared SSL issuer, and C2 infrastructure appearing in Google's analysis of the axios npm attack.
Wiz's autonomous red agent found a CI script-injection flaw that GitHub Advanced Security scanned and missed
Wiz reports its Red Agent found a script-injection flaw in the snowflake-connector-net repository's jira_issue.yml workflow, which interpolated an attacker-controlled GitHub issue title directly into a shell script on the issues-opened trigger, and used it to exfiltrate a Jira token with read access to Snowflake engineering, security compliance and bug bounty projects. Wiz says the flaw was introduced on June 18 2026, reported through HackerOne on June 23 and patched the same day, and that GitHub Advanced Security scanned the merged pull request without flagging it; Snowflake found no evidence of unauthorized access.