Research
PHP2Shell: From the attacker’s perspective
Executive Summary: Two faults in PHP, the software behind roughly seven out of ten websites, let a stranger on the...
All articles by Roi Nisimi
Discovered Vulnerabilities
Fixed on Main, Vulnerable in Release: Hunting Backport Gaps at Scale
Executive Summary: We scanned thousands of open source repositories for security fixes that are public on main but were never...
‘Orca Watch’ Series
Critical Pre-Auth RCE in ChromaDB Threatens AI Infrastructure
A max-severity vulnerability (CVE-2026-45829, CVSS 10.0) was disclosed affecting ChromaDB, the widely used open-source vector database for AI applications, allowing...
‘Orca Watch’ Series
Critical Coder Signature Bypass Exposes Developer Keys and Tokens
A critical vulnerability (CVE-2026-46354, CVSS 9.1) was disclosed affecting Coder, a popular open-source remote development platform, allowing attackers to steal...
‘Orca Watch’ Series
New “PoolSlip” NGINX Exploit Revives Unpatched Remote Code Execution Risk
Executive Summary Security researchers disclosed new exploitation techniques for the previously documented “PoolSlip” vulnerability affecting NGINX, demonstrating that earlier mitigations...
‘Orca Watch’ Series
Critical Drupal SQL Injection Exposes PostgreSQL-Backed Sites to Remote Code Execution
Executive Summary A highly critical vulnerability (CVE-2026-9082, Drupal risk score 20/25) was disclosed affecting Drupal core versions 8.9.0 through 11.3.9,...
‘Orca Watch’ Series
Massive npm Supply Chain Attack Compromises AntV Ecosystem, Steals CI/CD Secrets at Scale
Table of contentsAttack OverviewTechnical CapabilitiesAffected Packages and ExposureRecommended RemediationIncident StatusPotential ImpactHow can Orca help? A critical supply chain attack compromised...
Data and AI Security
The AI Data You Forgot to Lock: How Exposed Vector Databases Put Organizations at Risk
Table of contentsExecutive Summary: PII, Medical Records, and Credentials at RiskThe Rise of Vector Databases and Their Blind SpotsThe Root...
‘Orca Watch’ Series
Linux kernel vulnerability enables local theft of SSH host keys and /etc/shadow
Table of contentsExecutive SummaryVulnerability DetailsWhy This MattersAffected Systems and Proof of Concept (PoC)Recommended MitigationExploitation Risk and Threat OutlookPotential ImpactHow can...
Personalized Demo
See Orca Security in Action
Gain visibility, achieve compliance, and prioritize risks with the Orca Cloud Security Platform.
Chat with Us
See Orca Security in Action
Gain visibility, achieve compliance, and prioritize risks with the Orca Cloud Security Platform.
Chat with an Orca ExpertNo Slack account required.