‘Orca Watch’ Series
Credential‑Stealing Malware in LiteLLM Supply Chain Attack
Executive Summary A severe malware incident (no formal CVE yet, but tracked as a high‑risk supply chain compromise) was disclosed...
Research Pod
‘Orca Watch’ Series
CanisterWorm: When a CI/CD Breach Became a Self-Spreading npm Worm
A supply chain compromise moved from CI pipelines into the npm ecosystem, stealing secrets, hijacking packages, and persisting on developer...
Discovered Vulnerabilities
Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework
Table of contentsQuick OverviewCVSS RationaleWhat Is SGLang?Technical AnalysisRoot Cause: Python's pickle on Untrusted Network DataHow Pickle Deserialization Becomes Code ExecutionProposed...
Thought Leadership
New Malware Approaches, Same Key Indicators
Table of contentsKey TakeawaysIntroductionThe Industrialization of MaliceAI as the Producer, and Emerging Director, of MalwareAI-Written MalwareAI-Powered MalwareNo Matter How It’s...
‘Orca Watch’ Series
HackerBot-Claw: An AI-Assisted Campaign Targeting GitHub Actions Pipelines
Table of contentsExecutive summaryIntroductionWhy GitHub Actions Are a New Frontier for AttackersWhat Happened?What Is the Impact?How HackerBot-Claw Works (Attack Chain)Scan...
Research
Post-Exploitation at Scale: The Rise of AILM
AILM (AI-Induced Lateral Movement) is a new post-exploitation attack-vector where the pivot mechanism isn’t a subnet or an identity, but...
‘Orca Watch’ Series
Four Critical SolarWinds Serv-U RCE Flaws Enable Root Access
SolarWinds has released Serv-U 15.5.4 to address four critical vulnerabilities — CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, and CVE-2025-40541 (CVSS 9.1) — that...
Discovered Vulnerabilities
Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments
A high-severity vulnerability (CVE-2026-2441, CVSS pending vendor confirmation) has been disclosed in Google Chrome and the Chromium engine, allowing attackers...
‘Orca Watch’ Series
Critical CVE-2026-1731 Vulnerability in BeyondTrust Remote Support and PRA Exposes Systems to Remote Code Execution
Introduction A critical vulnerability (CVE-2026-1731, CVSS 9.9) was publicly disclosed on February 6, 2026 affecting BeyondTrust Remote Support (RS) and...
Personalized Demo
See Orca Security in Action
Gain visibility, achieve compliance, and prioritize risks with the Orca Cloud Security Platform.
Chat with Us
See Orca Security in Action
Gain visibility, achieve compliance, and prioritize risks with the Orca Cloud Security Platform.
Chat with an Orca ExpertNo Slack account required.