‘Orca Watch’ Series
Kyverno SSRF: Breaking Kubernetes Namespace Isolation (CVE-2026-4789)
A critical SSRF (Server-Side Request Forgery, where an attacker tricks a server into making HTTP requests on their behalf) vulnerability...
Research
Discovered Vulnerabilities
CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server
Table of contentsOverviewWhat Is ksmbd - and Why Does It Matter?Understanding SMB3 MultichannelThe Vulnerability - A Missing LockThe Broken Data...
Report
2026 State of Application Security Report
In-Depth Research 2026 State of Application Security Report When Development Velocity Outpaces Security Get the Report One clear picture of...
Application Security
2026 State of AppSec: When Development Velocity Outpaces Security
Today, we’re excited to release the 2026 State of Application Security Report, which reveals deep insights uncovered by the Orca...
Application Security
Supply Chain Attack on Axios Delivers Cross-Platform RAT via Compromised npm Account
Table of contentsQuick OverviewWhat is Axios?Technical AnalysisHow the account was compromisedThe phantom dependency trickInside the dropperPlatform-specific payloadsAnti-forensic evidence destructionAttack FlowAffected...
‘Orca Watch’ Series
Credential‑Stealing Malware in LiteLLM Supply Chain Attack
Executive Summary A severe malware incident (no formal CVE yet, but tracked as a high‑risk supply chain compromise) was disclosed...
‘Orca Watch’ Series
CanisterWorm: When a CI/CD Breach Became a Self-Spreading npm Worm
A supply chain compromise moved from CI pipelines into the npm ecosystem, stealing secrets, hijacking packages, and persisting on developer...
Discovered Vulnerabilities
Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework
Table of contentsQuick OverviewCVSS RationaleWhat Is SGLang?Technical AnalysisRoot Cause: Python's pickle on Untrusted Network DataHow Pickle Deserialization Becomes Code ExecutionProposed...
Thought Leadership
New Malware Approaches, Same Key Indicators
Table of contentsKey TakeawaysIntroductionThe Industrialization of MaliceAI as the Producer, and Emerging Director, of MalwareAI-Written MalwareAI-Powered MalwareNo Matter How It’s...
