Automated security testing reveals access risks at transit and medical facilities

Security researchers using AI-assisted scanning discovered that a public rail operator's exposed database could allow unauthorized access to administrative functions, and a hospital's alert system lacked proper access controls. They also found a separate medical facility's appointment site had a dangerous file-upload vulnerability that could compromise patient data. The findings are part of Wiz's 'Scan for Good' program, which pairs automated tools with human validation to help vulnerable organizations patch their systems.

The Scan for Good initiative combines automated AI-driven vulnerability discovery with human researcher validation, ensuring findings are confirmed before organizations are notified privately. Beyond the transit and healthcare cases, the program identified a municipal data service exposing personal, health, and financial records of roughly 5,000 elderly residents, plus an exposed administrator key that allowed read, modify, and delete access to 8.8 million files in a Middle Eastern national archive. Wiz reported that all identified exposures have been remediated, with no evidence that malicious actors exploited them. The company declined to name the affected organizations.

The findings highlight recurring vulnerability patterns: exposed credentials, missing permission checks, and unsafe file-upload features in public-facing systems. These are configuration and access-control failures rather than novel software flaws. The program's early results also included risks at technology providers whose products support other organizations, including a cloud provider where a credential in public website code could have enabled publishing malicious software across multiple downstream users.