Research
Frontier-Level Red-Teaming From a Self-Hostable Open-Weight Model: Testing NVIDIA Nemotron 3.5 Super
Key Findings AI agents are shipping into production faster than anyone is testing them. Every agent with tools, memory, and...
Research
‘Orca Watch’ Series
Critical GitLab RCE Lets Unauthenticated Attackers Execute Code on Servers (CVE-2026-97229)
Executive Summary A maximum-severity vulnerability (CVE-2026-97229, CVSS 10.0) was disclosed affecting GitLab Community Edition (CE) and Enterprise Edition (EE), allowing...
‘Orca Watch’ Series
Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads
Executive Summary A supply-chain attack targeting npm developers has been active since August 2023, distributing eight malicious packages that collectively...
‘Orca Watch’ Series
Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products
Executive Summary A critical vulnerability (CVE-2026-21589, CVSS 9.3) was disclosed affecting all versions of eight Atlassian Data Center and Server...
‘Orca Watch’ Series
Citrix NetScaler Zero-Day Exploited in the Wild Crashes SAML Authentication Services
Executive Summary A high-severity memory overflow vulnerability (CVE-2026-88779, CVSS v4.0 8.7) was disclosed affecting Citrix NetScaler ADC and NetScaler Gateway,...
‘Orca Watch’ Series
Critical Citrix NetScaler Zero-Days Under Active Exploitation
Executive Summary: NetScaler RCE Risk and Patch Deadline Two critical vulnerabilities (CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5) were disclosed affecting...
‘Orca Watch’ Series
WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments
Executive Summary A high-severity vulnerability (CVE-2026-93485, CVSS 7.1) was disclosed affecting WordPress Core, allowing attackers to achieve full remote code...
‘Orca Watch’ Series
npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader
Executive Summary A high-severity supply-chain attack was disclosed affecting the npm package @dforge-core/dforge-mcp, allowing attackers to distribute a remote-shell implant...
Research
Breaking: GitLab Critical Path Traversal Flaw Exploited in the Wild — Patch Immediately
Executive Summary A critical vulnerability (CVE-2026-85706, CVSS 10.0) was disclosed affecting GitLab CE and EE self-managed instances, allowing attackers to...