Research
Bringing Memory to AI: A Look at A2A and MCP-like Technologies Across Platforms
Over the last year, we've witnessed a pivotal shift in how large language models (LLMs) are used - not just...
Research Pod
Discovered Vulnerabilities
Kubernetes CRD Abstraction Risks in kro
Executive Summary: The Orca Research Pod has discovered CVE-2025-48710 in kro (Kube Resource Orchestrator) where an attacker could introduce a malicious CustomResourceDefinition...
Discovered Vulnerabilities
‘IngressNightmare’: Critical Vulnerabilities in Ingress NGINX Controller Allow Unauthenticated Remote Code Execution
On March 24th, 2025, Wiz’s research team published information on five vulnerabilities in the Ingress NGINX Controller for Kubernetes (ingress-nginx)...
Discovered Vulnerabilities
Oracle Cloud Breach Exploiting CVE-2021-35587: How to Protect Your Organization
Read about the Oracle Cloud Breach Exploiting CVE-2021-35587 and learn how to protect your organization.
Research
Infrastructure as Code: Common Security Risks and How to Prevent Them
Check out this Orca Security article that outlines infrastructure as code (IaC) security risks and offers recommended methods for protecting...
Discovered Vulnerabilities
SynLapse – Technical Details for Critical Azure Synapse Vulnerability
Recently, the Orca Security research team discovered SynLapse, a tenant separation violation vulnerability in the Microsoft Azure Synapse environment.
‘Orca Watch’ Series
Supply Chain Attack: CTX Account Takeover and PHPass Hijack Explained
A threat actor recently hacked a popular PyPi repo on GitHub, setting off a supply chain attack that could have...
Discovered Vulnerabilities
Security Advisory: Insufficient Tenant Separation in Azure Synapse Service
This security advisory addresses a tenant separation issue in the Microsoft Azure Synapse service.
‘Orca Watch’ Series
Open Source Package Risks in Cloud Environments and How It Relates to the Russian-Ukrainian Conflict
Protestware malicious code found in NPM package node-ipc in Russia / Belarus, overwriting entire file systems with heart emojis to...
Google Cloud
GCP Organization Policies: Governing Your Inheritance
A GCP Organization is the top node of the permissions hierarchy, making policies defined at this level powerful, automatically applying...
‘Orca Watch’ Series
Unfolding the Log4j Security Vulnerability and Log4shell TTPs in AWS
Orca researcher Lidor Ben Shitrit reveals how Log4 shell TTPs in an AWS cloud environment can be used to open...
‘Orca Watch’ Series
CVE-2018-25032: Zlib Memory Corruption Vulnerability
On March 25, 2022, a PoC was published for the 4-year old CVE-2018-25032 in Zlib open source software that everyone...
Discovered Vulnerabilities
BreakingFormation: Technical Vulnerability Walkthrough
BreakingFormation is an XML External Entity (XXE) vulnerability found in AWS CloudFormation that led to local file disclosure, directory listing,...
Personalized Demo
See Orca Security in Action
Gain visibility, achieve compliance, and prioritize risks with the Orca Cloud Security Platform.