Cloud Security Research & Threat Intelligence

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

Executive Summary A high-severity vulnerability (CVE-2026-93485, CVSS 7.1) was disclosed affecting WordPress Core, allowing attackers to achieve full remote code execution via a stored cross-site scripting flaw in the comment rendering pipeline. Due to the potential for complete server compromise, immediate patching is required. About CVE-2026-93485 The issue originates from the wpautop() function in wp-includes/formatting.php, …

September 22, 2026
By The Orca Research Pod

Latest

All Latest

Explore

Discovered Vulnerabilities

Digital illustration of a winding data stream that splits into two paths, one continuing with glowing blue particles and the other filled with glowing red particles.

How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code

TL;DR When a critical nginx vulnerability hits the headlines, security teams patch nginx. But what if the same vulnerable code is running somewhere they’re not looking? While the rest of the industry was busy patching nginx, Orca’s Threat Research Team was asking a different question and the answer led us straight to Tengine. Tengine, Alibaba’s …

June 16, 2026
By Daniel Ufliand & Yonatan Levi

Cyber-themed illustration of a Linux SMB3 server with a broken padlock, symbolizing a missing lock vulnerability in ksmbd.

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

April 08, 2026

A stylized graphic of a pickle smashing into a pipeline

Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework

March 11, 2026

Stylized 3D visualization of an active cybersecurity exploit featuring glowing red computer code fragments and a central target aperture.

Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments

February 23, 2026

A stylized graphic of ominous clouds with a digitized skull on top

RoguePilot: Exploiting GitHub Copilot for a Repository Takeover

February 16, 2026

All Discovered Vulnerabilities

In the News

All In the News

2026 State of AI Security Report: AI Security Findings from 1,200+ Production Organizations

Get the Report

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

Latest

npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

Zoom Zero-Click RCE Flaws Allow Any Meeting Attendee to Compromise All Participants

Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack

Explore

Discovered Vulnerabilities

How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework

Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments

RoguePilot: Exploiting GitHub Copilot for a Repository Takeover

‘Orca Watch’ Series

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack

OpenAI Agents Escape Testing Sandbox and Breach Hugging Face Production Infrastructure

Technical Deep Dives

SOC Automation: AI-Driven Tools and Best Practices

Agentic AI Security: Risks, Controls & Framework

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Supply Chain Attack on Axios Delivers Cross-Platform RAT via Compromised npm Account

Post-Exploitation at Scale: The Rise of AILM

Thought Leadership

Building Orca’s Partner Portal: What Happens When a Non-Engineer Builds With AI

It Was Not a Warning Shot. It Was the First of Many.

Cloud Security LIVE 2026 Recap: What Security Practitioners Are Actually Doing With AI

Orca Security Recognized in the 2026 TAG Enterprise AI Security Handbook

Navigating Cloud Security in 2026: Join Cloud Security LIVE

In the News

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2026 State of AI Security Report: AI Security Findings from 1,200+ Production Organizations

Featured

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

Latest

npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

Zoom Zero-Click RCE Flaws Allow Any Meeting Attendee to Compromise All Participants

Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack

Discovered Vulnerabilities

How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework

Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments

RoguePilot: Exploiting GitHub Copilot for a Repository Takeover

‘Orca Watch’ Series

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack

OpenAI Agents Escape Testing Sandbox and Breach Hugging Face Production Infrastructure

Technical Deep Dives

SOC Automation: AI-Driven Tools and Best Practices

Agentic AI Security: Risks, Controls & Framework

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Supply Chain Attack on Axios Delivers Cross-Platform RAT via Compromised npm Account

Post-Exploitation at Scale: The Rise of AILM

Thought Leadership

Building Orca’s Partner Portal: What Happens When a Non-Engineer Builds With AI

It Was Not a Warning Shot. It Was the First of Many.

Cloud Security LIVE 2026 Recap: What Security Practitioners Are Actually Doing With AI

Orca Security Recognized in the 2026 TAG Enterprise AI Security Handbook

Navigating Cloud Security in 2026: Join Cloud Security LIVE

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2026 State of AI Security Report: AI Security Findings from 1,200+ Production Organizations