Research
Post-Exploitation at Scale: The Rise of AILM
AILM (AI-Induced Lateral Movement) is a new post-exploitation attack-vector where the pivot mechanism isn’t a subnet or an identity, but...
Research
‘Orca Watch’ Series
Four Critical SolarWinds Serv-U RCE Flaws Enable Root Access
SolarWinds has released Serv-U 15.5.4 to address four critical vulnerabilities — CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, and CVE-2025-40541 (CVSS 9.1) — that...
Discovered Vulnerabilities
Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments
A high-severity vulnerability (CVE-2026-2441, CVSS pending vendor confirmation) has been disclosed in Google Chrome and the Chromium engine, allowing attackers...
‘Orca Watch’ Series
Critical CVE-2026-1731 Vulnerability in BeyondTrust Remote Support and PRA Exposes Systems to Remote Code Execution
Introduction A critical vulnerability (CVE-2026-1731, CVSS 9.9) was publicly disclosed on February 6, 2026 affecting BeyondTrust Remote Support (RS) and...
Discovered Vulnerabilities
RoguePilot: Exploiting GitHub Copilot for a Repository Takeover
We forced GitHub to prompt-inject itself. It allowed us to control Copilot’s responses and exfiltrate Codespaces’ GITHUB_TOKEN secret. The end...
‘Orca Watch’ Series
Path Traversal in Rancher Local Path Provisioner Enables Host Filesystem Compromise Across K3s Clusters
Introduction A critical vulnerability (CVE-2025-62878, CVSS 10.0) was disclosed on February 4, 2026 affecting all versions of Rancher's Local Path...
Discovered Vulnerabilities
Hacking GitHub Codespaces via VS Code Defaults: A Supply-Chain Attack Vector
Executive Summary The Orca Research Pod has uncovered multiple attack vectors in GitHub Codespaces that allow remote code execution (RCE)...
‘Orca Watch’ Series
Critical RCE in vLLM Allows Server Takeover via Malicious Video URL (CVE-2026-22778)
Introduction A critical vulnerability (CVE-2026-22778, CVSS 9.8) was disclosed on February 2, 2026, affecting vLLM, a widely-deployed Python library for...
‘Orca Watch’ Series
Notepad++ Update Mechanism Hijacked by State-Sponsored Actors for Six Months
Introduction State-sponsored attackers compromised Notepad++'s hosting infrastructure from June through December 2025, hijacking the application's update mechanism to deliver malicious...