Orca Security

Orca’s cloud security solution deploys in minutes and identifies vulnerabilities, malware, misconfigurations, secret keys, leaked passwords, lateral movement risk, and high-risk data such as PII.

Website: orca.security · all feeds from this site
Feed URL: https://orca.security/feed/

Read it in your FeedListing reader

Latest posts

CVE-2026-101767: Critical Oracle EBS SQL Injection Actively Probed in the Wild 28 Oct 2026
What is CVE-2026-101767? A critical vulnerability (CVE-2026-101767, CVSS 9.8) was disclosed affecting Oracle E-Business Suite’s Application Object Library, allowing attackers to achieve full remote code execution and system takeover via an unauthenticated SQL injection in the…
Securing Vercel at Scale: From One Team to Every Team 27 Oct 2026
On Thursday, a customer marketing manager vibe codes a community portal where customers can sign in, post questions, and search past answers. By Friday it’s live on Vercel, with a custom domain, an OPENAI_API_KEY for the AI search saved as a plain config variable, and a database…
Calling All Builders: Meet Orca Security at AWS re:Invent 2026 27 Oct 2026
Software isn’t just built by developers anymore. Business teams, citizen developers, and AI agents are all shipping apps now, on top of more code, more models, and more cloud than ever. AWS re:Invent is where the people doing that building get together, and we can’t think of a…
Node.js Brotli Decoder Out-of-Bounds Write Threatens Remote Code Execution Across All Supported Versions 27 Oct 2026
Executive Summary: A high-severity vulnerability (CVE-2026-111497) was disclosed affecting Node.js across all supported release lines (22.x, 24.x, 26.x), allowing attackers to achieve remote code execution via malformed Brotli-compressed data processed by node:zlib or fetch().…
PHP2Shell: From the attacker’s perspective 26 Oct 2026
Executive Summary: What are CVE-2026-109618 and CVE-2026-109619? Why PHP vulnerabilities put most of the web at risk When you open a web page, something has to build that page before it reaches you. For roughly seven out of ten websites, the software doing that job is PHP. It…
PHP2Shell: What This Week Tells Us About the Web We Built 23 Oct 2026
The week the web’s plumbing failed On Wednesday afternoon, most of the world’s websites became exploitable at the same moment. The reason was PHP, the thirty-year-old language that still serves roughly seven out of ten sites you visit, including nearly every WordPress, Drupal,…
Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2) 21 Oct 2026
Executive Summary Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) were disclosed affecting PHP, allowing attackers to execute arbitrary code remotely at the PHP runtime level, before application code runs. Due to the potential for full server…
Benchmark Your AI Security Maturity in Under a Minute 21 Oct 2026
Five years ago, AI security was a forward-looking line item. Today it’s an operational reality, and the data shows most security programs haven’t caught up. In the 2026 State of AI Security report, the Orca Research Pod found that 51.5% of organizations are building custom AI…
From Security Debt to Zero Criticals: Orca MCP and Claude Code 20 Oct 2026
Security debt behaves like the financial kind. Nobody takes it on deliberately. It accrues one skipped base image bump at a time, and the interest shows up as a backlog no one owns. The pattern is familiar to anyone who has inherited a cloud estate. Hundreds of repos. A fleet of…
How to Build Your Actual Network Map with Custom Agents in Orca 16 Oct 2026
Ask most teams for a map of their network and you’ll get one of two things: a diagram someone drew for an audit two years ago, or an export from the firewall and cloud consoles showing what each rule allows. Both describe intent. Neither describes what an attacker on the…