Report
2026 State of AI Security Report
In-Depth Research 2026 State of AI Security Report AI Security Findings from 1,200+ Production Organizations Get the Report AI Adoption...
Research
Data and AI Security
2026 State of AI Security: AI Is in Production. Security Isn’t.
Today, we're releasing the 2026 State of AI Security Report, a comprehensive analysis of how artificial intelligence has moved from...
‘Orca Watch’ Series
Maximum-Severity Adobe ColdFusion Flaw Exploited Within Hours of Disclosure
A critical vulnerability (CVE-2026-48282, CVSS 10.0) was disclosed affecting Adobe ColdFusion, allowing attackers to achieve full remote code execution via...
‘Orca Watch’ Series
FortiBleed Campaign Harvests 110M+ Credentials, Fuels Ransomware Operations
A critical credential-harvesting campaign dubbed “FortiBleed” has been exposed, systematically targeting over 430,000 FortiGate firewalls worldwide and exploiting CVE-2026-35616 (CVSS...
‘Orca Watch’ Series
Langflow RCE Actively Exploited to Deploy Cryptominers on AI Infrastructure
A critical vulnerability (CVE-2026-33017, CVSS 9.8) was disclosed affecting Langflow, a widely used open-source AI application builder, allowing attackers to...
‘Orca Watch’ Series
144 Mastra npm Packages Compromised via Supply Chain Attack
A critical supply chain attack was disclosed affecting the entire @mastra/* npm scope, allowing attackers to deploy a cross-platform infostealer...
Discovered Vulnerabilities
How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code
TL;DR When a critical nginx vulnerability hits the headlines, security teams patch nginx. But what if the same vulnerable code...
‘Orca Watch’ Series
Critical Langflow Path Traversal Flaw Exploited for Unauthenticated RCE
Executive Summary A high-severity vulnerability (CVE-2026-5027, CVSS 8.8) was disclosed affecting Langflow, an open-source low-code platform widely used for building...
‘Orca Watch’ Series
Critical PhpSpreadsheet RCE Patch Bypass Puts Millions at Risk
Executive Summary A critical vulnerability (CVE-2026-45034, CVSS 9.8) was disclosed affecting PhpSpreadsheet, the widely-used PHP library with over 312 million...