Cloud Security Research & Threat Intelligence

Critical Citrix NetScaler Zero-Days Under Active Exploitation

Executive Summary: NetScaler RCE Risk and Patch Deadline Two critical vulnerabilities (CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5) were disclosed affecting Citrix NetScaler ADC and NetScaler Gateway, allowing attackers to achieve unauthenticated remote code execution via improper input validation and memory overflow flaws. Due to confirmed active exploitation globally and their inclusion in CISA’s Known Exploited …

September 29, 2026
By The Orca Research Pod

Latest

All Latest

Explore

Discovered Vulnerabilities

Digital illustration of a winding data stream that splits into two paths, one continuing with glowing blue particles and the other filled with glowing red particles.

How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code

TL;DR When a critical nginx vulnerability hits the headlines, security teams patch nginx. But what if the same vulnerable code is running somewhere they’re not looking? While the rest of the industry was busy patching nginx, Orca’s Threat Research Team was asking a different question and the answer led us straight to Tengine. Tengine, Alibaba’s …

June 16, 2026
By Daniel Ufliand & Yonatan Levi

Cyber-themed illustration of a Linux SMB3 server with a broken padlock, symbolizing a missing lock vulnerability in ksmbd.

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

April 08, 2026

A stylized graphic of a pickle smashing into a pipeline

Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework

March 11, 2026

Stylized 3D visualization of an active cybersecurity exploit featuring glowing red computer code fragments and a central target aperture.

Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments

February 23, 2026

A stylized graphic of ominous clouds with a digitized skull on top

RoguePilot: Exploiting GitHub Copilot for a Repository Takeover

February 16, 2026

All Discovered Vulnerabilities

In the News

All In the News

2026 State of AI Security Report: AI Security Findings from 1,200+ Production Organizations

Get the Report

Critical Citrix NetScaler Zero-Days Under Active Exploitation

Latest

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

Zoom Zero-Click RCE Flaws Allow Any Meeting Attendee to Compromise All Participants

Explore

Discovered Vulnerabilities

How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework

Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments

RoguePilot: Exploiting GitHub Copilot for a Repository Takeover

‘Orca Watch’ Series

Critical Citrix NetScaler Zero-Days Under Active Exploitation

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack

Technical Deep Dives

SOC Automation: AI-Driven Tools and Best Practices

Agentic AI Security: Risks, Controls & Framework

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Supply Chain Attack on Axios Delivers Cross-Platform RAT via Compromised npm Account

Post-Exploitation at Scale: The Rise of AILM

Thought Leadership

Amazing and Terrifying: Securing an App Built By AI in a Weekend

Building Orca’s Partner Portal: What Happens When a Non-Engineer Builds With AI

It Was Not a Warning Shot. It Was the First of Many.

Cloud Security LIVE 2026 Recap: What Security Practitioners Are Actually Doing With AI

Orca Security Recognized in the 2026 TAG Enterprise AI Security Handbook

In the News

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2026 State of AI Security Report: AI Security Findings from 1,200+ Production Organizations

Featured

Critical Citrix NetScaler Zero-Days Under Active Exploitation

Latest

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

Zoom Zero-Click RCE Flaws Allow Any Meeting Attendee to Compromise All Participants

Discovered Vulnerabilities

How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework

Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments

RoguePilot: Exploiting GitHub Copilot for a Repository Takeover

‘Orca Watch’ Series

Critical Citrix NetScaler Zero-Days Under Active Exploitation

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack

Technical Deep Dives

SOC Automation: AI-Driven Tools and Best Practices

Agentic AI Security: Risks, Controls & Framework

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Supply Chain Attack on Axios Delivers Cross-Platform RAT via Compromised npm Account

Post-Exploitation at Scale: The Rise of AILM

Thought Leadership

Amazing and Terrifying: Securing an App Built By AI in a Weekend

Building Orca’s Partner Portal: What Happens When a Non-Engineer Builds With AI

It Was Not a Warning Shot. It Was the First of Many.

Cloud Security LIVE 2026 Recap: What Security Practitioners Are Actually Doing With AI

Orca Security Recognized in the 2026 TAG Enterprise AI Security Handbook

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2026 State of AI Security Report: AI Security Findings from 1,200+ Production Organizations