Cloud Security Learning
Getting Ready for the AI Era: A CISO’s Guide to AI Security Strategy
The AI Era Is a Scale Problem — And CISOs Can’t Solve It the Old Way Every major technology shift...
Blog
‘Orca Watch’ Series
Path Traversal in Rancher Local Path Provisioner Enables Host Filesystem Compromise Across K3s Clusters
Introduction A critical vulnerability (CVE-2025-62878, CVSS 10.0) was disclosed on February 4, 2026 affecting all versions of Rancher's Local Path...
Orca Platform
Shifting Left with Orca MCP: The Developer’s AI Security Partner
In Part 1, we explored how the Orca MCP (Model Context Protocol) Server bridges the gap between AI and your...
Discovered Vulnerabilities
Hacking GitHub Codespaces via VS Code Defaults: A Supply-Chain Attack Vector
Executive Summary The Orca Research Pod has uncovered multiple attack vectors in GitHub Codespaces that allow remote code execution (RCE)...
Orca Platform
First third-party CNAPP to integrate with Tencent Cloud: Orca expands multi-cloud security and compliance with dynamic risk prioritization baked in
Today, we’re excited to announce that Orca can be integrated with Tencent Cloud. This makes Orca the first third-party Cloud...
‘Orca Watch’ Series
Critical RCE in vLLM Allows Server Takeover via Malicious Video URL (CVE-2026-22778)
Introduction A critical vulnerability (CVE-2026-22778, CVSS 9.8) was disclosed on February 2, 2026, affecting vLLM, a widely-deployed Python library for...
Orca Platform
The Productivity Catalyst: How Context-Aware Security Unlocks Developer Velocity
In traditional DevOps models, security is often perceived as a “tax” on innovation. It is often seen as a necessary...
‘Orca Watch’ Series
Notepad++ Update Mechanism Hijacked by State-Sponsored Actors for Six Months
Introduction State-sponsored attackers compromised Notepad++'s hosting infrastructure from June through December 2025, hijacking the application's update mechanism to deliver malicious...
‘Orca Watch’ Series
Critical n8n Sandbox Escape Enables Remote Code Execution
A critical vulnerability (CVE-2026-1470, CVSS 9.9) was disclosed on January 27, 2026 affecting n8n, the popular open-source workflow automation platform....