Research
Bringing Memory to AI: A Look at A2A and MCP-like Technologies Across Platforms
Over the last year, we've witnessed a pivotal shift in how large language models (LLMs) are used - not just...
Research Pod
Discovered Vulnerabilities
Kubernetes CRD Abstraction Risks in kro
Executive Summary: The Orca Research Pod has discovered CVE-2025-48710 in kro (Kube Resource Orchestrator) where an attacker could introduce a malicious CustomResourceDefinition...
Discovered Vulnerabilities
‘IngressNightmare’: Critical Vulnerabilities in Ingress NGINX Controller Allow Unauthenticated Remote Code Execution
On March 24th, 2025, Wiz’s research team published information on five vulnerabilities in the Ingress NGINX Controller for Kubernetes (ingress-nginx)...
Discovered Vulnerabilities
Oracle Cloud Breach Exploiting CVE-2021-35587: How to Protect Your Organization
Read about the Oracle Cloud Breach Exploiting CVE-2021-35587 and learn how to protect your organization.
‘Orca Watch’ Series
CVE-2022-0847: Linux Dirty Pipe Local Privilege Escalation Vulnerability
A new critical Linux privilege escalation vulnerability was published under the ID CVE-2022-0847, named “Dirty Pipe.”
Discovered Vulnerabilities
AutoWarp: Critical Cross-Account Vulnerability in Microsoft Azure Automation Service
AutoWarp is a critical vulnerability in Microsoft Azure Automation Service that allows unauthorized access to other customer accounts using the...
Research
Lateral Movement in Google Cloud: Abusing the Infamous Default Service Account Misconfiguration
How a malicious actor can conduct lateral movement in Google Cloud across compute engine instances using the default service account.
Discovered Vulnerabilities
Oracle Server Side Request Forgery (SSRF) Metadata
Analyzing customer environments is always a detective task, and when we find structural flaws in a service provider, this is...
Discovered Vulnerabilities
A Tale About Vulnerability Research and Early Detection
Orca Security, as part of an ongoing research effort, discovered a vulnerability in the Databricks platform, and Databricks took swift...
‘Orca Watch’ Series
Linux Privilege Escalation Vulnerability in Polkit’s pkexec
A new critical Linux local privilege escalation vulnerability, found on Polkit's pkexec utility, was published and assigned CVE-2021-4034.
‘Orca Watch’ Series
HTTP Protocol Stack Remote Code Execution Vulnerability
On Jan. 11, 2022, an HTTP Protocol stack remote code execution security vulnerability was identified. Microsoft assigned the CVE 2022-21907...
Discovered Vulnerabilities
BreakingFormation: Orca Security Research Team Discovers AWS CloudFormation Vulnerability
Orca Security’s vulnerability researcher, Tzah Pahima, discovered a vulnerability in AWS allowing file and credential disclosure of an AWS internal...
Discovered Vulnerabilities
Superglue: Orca Security Research Team Discovers AWS Glue Vulnerability
Orca's Research Team discovered a critical vulnerability that could allow an actor to create resources and access data of AWS...
Personalized Demo
See Orca Security in Action
Gain visibility, achieve compliance, and prioritize risks with the Orca Cloud Security Platform.