The threat group’s remarkable success targeting open-source software was inevitable and fueled by the industry’s decision to prioritize code shipping over security.

Ryan Kazanciyan | CIO & CISO | Wiz

The high-severity vulnerability is under active exploitation and affects many versions of MongoDB, a nearly ubiquitous open-source database.

Researchers warn that half of the exposed vulnerable instances remain unpatched as in-the-wild exploitation grows rapidly.

A debate over actual exploitation is muddying response efforts. Multiple researchers say they’ve observed working proof of concepts while others assert evidence of attacks is lacking.

The open-source code library is one of the most extensively used application frameworks. Wiz found vulnerable versions in around 39% of cloud environments.

Self-replicating malware has infected almost 500 open-source packages, exposing more than 26,000 GitHub repositories in less than 24 hours.

Cyber defenders say AI technologies are quickly evolving to help stop sophisticated threat groups, including Chinese adversaries, from embedding themselves inside target organizations.

Wiz co-founder Asaaf Rappaport said the company will remain focused on protecting a wide range of cloud services.

Bryan Rosensteel | Head of Public Sector Product Marketing | Wiz