Orca Security

The agentless cloud security pioneer for #AWS, #Azure, #GoogleCloud, #Kubernetes and more.

[Orca Security @orcasec]

#ZenithLive is almost here!

Find us at booth S6 for cloud security convos and yes, of course, Orca swag.

Come hang with the Orca Pod! We can't wait to see you! 👋

Join us for our Happy Hour on June 9th too 🍹 Grab your spot here → https://t.co/iew9q1IiOv

[Orca Security @orcasec]

🚨 Critical WordPress flaw: 150,000 sites vulnerable to admin takeover

Attackers exploit a broken password reset in the Kirki plugin to hijack accounts — no credentials needed.

On Kirki 6.0.0–6.0.6? Patch to 6.0.7 now.

Full breakdown: https://t.co/09hJKflmnv

[Orca Security @orcasec]

Orca Sensor is now available for FedRAMP-authorized environments. 🎉

Runtime visibility, behavioral telemetry, real-time workload monitoring. The proof of security that FedRAMP and NIST 800-53 actually require.

Here's how it works: https://t.co/SyPH33unwm

[Orca Security @orcasec]

🚨 Red Hat npm packages were backdoored with a credential-stealing worm that runs on npm install, silently sweeping AWS, GCP, Azure keys, SSH keys, Kubernetes configs, and more.

Affected? Rotate your credentials now.

Full breakdown + package list: https://t.co/6CKGlDNAZZ

[Orca Security @orcasec]

Heading to #ZenithLive? Come hang with us and @GuidePointSec at our Happy Hour June 9th.

Talk Zero Trust, SASE, and cloud security over drinks. Spots are limited, grab yours: https://t.co/iew9q1IiOv

Can't make it? Find us at booth S6. Good convos and Orca swag await.

[Orca Security @orcasec]

🚨 Critical vulnerability alert: CVE-2026-27771

Your private container images might not be so private.

CVE-2026-27771 lets anyone pull private Gitea images with zero credentials. Source code, API keys, database passwords... all exposed.

How to fix: https://t.co/jcBQzD6AXz

[Orca Security @orcasec]

Orca Security is now distributed through TD SYNNEX, and we're kicking things off with a live webinar tomorrow. Come see the platform, the opportunity, and how to get involved.

📅 Wednesday, May 27 | 2:30 PM ET

🔗 Register here: https://t.co/6VaO5NxRgF

[Orca Security @orcasec]

🚨 Critical Unauthenticated RCE in Kopia Backup

A critical vulnerability, CVE-2026-45695 (CVSS 9.8), affects Kopia's HTTP server v0.22.3 and earlier.

One unauthenticated HTTP request = arbitrary code execution. Upgrade to v0.23.0 now.

👉 https://t.co/UQTOhJ5QHb

[Orca Security @orcasec]

🚨 Critical Drupal SQL Injection Exposes Sites to RCE

CVE-2026-9082 affects Drupal core 8.9.0 through 11.3.9. No auth required, and the Drupal Security Team warns exploits could emerge within hours. Patch now.

How Orca can help: https://t.co/XrXW4vsbPA

[Orca Security @orcasec]

⚠️ "PoolSlip" NGINX Exploit Revives Unpatched Remote Code Execution Risk

RCE is still achievable, a PoC is already public, and no vendor patch exists yet. If NGINX is in your stack, review your configs now.

How Orca can help: https://t.co/4dYasdKnkP

[Orca Security @orcasec]

🚨 Critical Pre-Auth RCE in ChromaDB Threatens AI Infrastructure

CVE-2026-45829 (CVSS 10.0) allows unauthenticated attackers to execute arbitrary code on ChromaDB servers. 73% of exposed instances are vulnerable.

Full breakdown and how Orca can help: https://t.co/SAb16KZvD2

[Orca Security @orcasec]

🚨 Critical Alert

CVE-2026-46354 lets attackers bypass Coder's signature verification and walk away with your SSH keys & OAuth tokens. Zero auth needed.

We broke it down, and what to do about it 👇
https://t.co/WJNXS6SNhL

[Orca Security @orcasec]

AI-curious vs. AI-first. There's a big difference, and we're talking about it in Boston.

Join us for an invite-only gathering of execs and AI practitioners focused on turning AI adoption into real, measurable business outcomes. Part of #BOSTechWeek.

👉 https://t.co/UZzT2fFE88

[Orca Security @orcasec]

🚨 Critical Alert for JavaScript and Node.js Developers

323 npm packages have been backdoored.

16 million weekly downloads. Credentials stolen automatically on npm install.

If your pipeline ran on May 19, assume exposure.

🔗 https://t.co/PdYLONreM3

[Orca Security @orcasec]

🔓 Vector databases are leaking sensitive data, no auth required.

Our team found exposed instances containing:
• PII and home addresses
• Medical records and biometric data
• Plaintext cloud credentials

New research + 6 steps to fix it 👇
https://t.co/g3qcQ0jnxl

[Orca Security @orcasec]

77% of organizations hold critical container vulnerabilities for 90+ days.

The problem isn't visibility. It's prioritization.

There's a lot more where that came from. Full breakdown from our 2026 State of AppSec Report here: https://t.co/RH7oLLGmCn

[Orca Security @orcasec]

Attending #GartnerSEC this June? So are we. 👋

Swing by the Orca booth in National Harbor, we’d love to chat. And while you’re there, try your hand at our Key to Win game. (Trust us, you’ll want to.)

What topics are you most looking forward to? ⬇️
https://t.co/mAGv2QnSa8

[Orca Security @orcasec]

🚨 Critical NGINX flaw alert

CVE-2026-42945 lets unauthenticated attackers crash servers and potentially execute malicious code. No login needed. A public exploit is already on GitHub.

If you're running NGINX, patch now. We have the full breakdown.

🔗 https://t.co/F6QlcTHPmY

[Orca Security @orcasec]

🚀 Introducing Orca's AI Skills Hub

Connect Claude, Codex, or Cursor to Orca's MCP Server and get verdict-first cloud security analysis in plain English.

11 out-of-the-box skills. Fully open-source.

🔗 https://t.co/GvfDgrxyYu

[Orca Security @orcasec]

🚨 A supply chain worm just hit TanStack, Mistral AI, UiPath, and 160+ other npm/PyPI packages.

It steals credentials, self-propagates, and can wipe your home directory.

We break down what happened and how to respond:
https://t.co/Sovbx5uGxz