‘Orca Watch’ Series
Credential‑Stealing Malware in LiteLLM Supply Chain Attack
Executive Summary A severe malware incident (no formal CVE yet, but tracked as a high‑risk supply chain compromise) was disclosed...
Blog
Orca Platform
Mission Accomplished: Orchestrate Your Remediation Strategy With Orca Missions
Table of contentsThe Problem: Alert Fatigue and Disconnected EffortsThe Solution: Organized, Outcome-Driven Security with Orca MissionsHow Orca Missions Work–A Closer...
Data and AI Security
The Orca Approach to Runtime AI Security
The Runtime Gap: Why AI Security Can't Stop at Posture Most AI security conversations in 2025 centered on posture. What...
‘Orca Watch’ Series
CanisterWorm: When a CI/CD Breach Became a Self-Spreading npm Worm
A supply chain compromise moved from CI pipelines into the npm ecosystem, stealing secrets, hijacking packages, and persisting on developer...
Application Security
From Findings to Fixes with Code Reachability, AppSec Triage Agent, and the AppSec Dashboard
Table of contentsKey FindingsIntroductionWhy Traditional AppSec Approaches Break DownFocusing on What Actually Runs (Code Reachability)Turning Findings into Action (AppSec Triage...
Data and AI Security
Introducing the Agentic Cloud Security Platform
Table of contentsOrca’s AI agents: Ecosystem engineers for cloud-native appsWhy build AI agents for CNAPP?What we’re building: Agentic AI for...
Data and AI Security
First Look: Orca’s RSAC 2026 Announcements
Over the past decade, protecting cloud-native applications has evolved. At first, security was reactive, driven by the traditional agent approach....
Thought Leadership
Beyond the Sticker Price: Understanding the True Cost of Your Security Tools
Beyond the Sticker Price: Understanding the True Cost of Your Security Tools As cyber security leaders, our fundamental mission is...
Discovered Vulnerabilities
Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework
Table of contentsQuick OverviewCVSS RationaleWhat Is SGLang?Technical AnalysisRoot Cause: Python's pickle on Untrusted Network DataHow Pickle Deserialization Becomes Code ExecutionProposed...
