Orca Security

Orca Security

https://orca.security
https://www.linkedin.com/company/orca-security/

Orca Security is a privately owned company headquartered in the US, founded in 2019 and employing approximately 480 individuals. Its main product is in computer and network security. The company provides a platform that identifies, prioritizes, and remediates security risks and compliance issues across cloud estates spanning AWS, Azure, Google Cloud, and Kubernetes.

Revenue

Founded

2019

Headcount

478

Headquarters

US

Primary Segment

Computer and Network Security

Ownership

Privately Owned

News Summary:

On April 30, 2026, a critical vulnerability (CVE-2026-3854, CVSS 8.7) was disclosed, affecting GitHub Enterprise Server and GitHub.com by allowing attackers to execute arbitrary commands on backend servers via a single git push command, with the potential for full server compromise. Earlier on the same day, a Linux kernel vulnerability (CVE-2026-31431), dubbed "Copy Fail," was reported, enabling an unprivileged local user to gain root access by corrupting the page cache of readable files without modifying the disk file. Previously, on April 27, the company highlighted insights from Cloud Security LIVE 2026, noting AI's role in reshaping the cloud security landscape, expanding attack surfaces, and increasing the need for security leaders to communicate risk. On April 23, a critical supply chain compromise affecting the Xinference Python ecosystem allowed attackers to execute arbitrary code and fully compromise developer environments via malicious package versions. This followed an earlier disclosure on April 23 of a critical supply chain vulnerability (CVE-2026-33634, CVSS 9.4) impacting Checkmarx GitHub Actions and developer tooling, which permitted attackers to steal sensitive credentials from CI/CD environments through poisoned workflows and malicious extensions.

Similar Companies

Subscribe for full access to Orca Security's profile

Orca Security offers products in the telecoms tech industry. Orca Security's product portfolio comprises of enterprise security.

Subscribe for full access to Orca Security's products in full detail

Subscribe for full access to Orca Security's revenue in full detail

May

28th

2026

19:18

Events, Emerging Tech, Artificial Intelligence, B2B Tag

AI, NHIs, and the New Era of Cloud Risk Cloud Security Information Technology Virtualization Cloud Computing IT Security IT Governance, Risk and Compliance The Future of Cloud Security: 2026 Trends and Insights from GigaOm Hybrid Cloud Security: A Deep D

Presented by Clarke Rodgers of the Office of the CISO at AWS, Gil Geron CEO at Orca Security

May

27th

2026

09:33

Gitea Container Registry Exposes Private Images to Unauthenticated Attackers

A critical access control vulnerability (CVE-2026-27771) has been disclosed in Gitea’s built-in container registry, allowing any unauthenticated remote attacker to pull container images marked as private, without credentials, tokens, or prior access of any kind. Due to the potential for full exposure of application source code, embedded secrets, and production infrastructure details, immediate patching is required.

May

26th

2026

10:16

Critical Unauthenticated RCE in Kopia Backup via SSH ProxyCommand Injection

A critical vulnerability (CVE-2026-45695, CVSS 9.8) was disclosed affecting Kopia, the open-source backup and restore tool, allowing attackers to achieve unauthenticated remote code execution via SSH command-line argument injection. Due to the potential for full system compromise without any authentication, immediate patching is required.

May

21st

2026

15:01

Emerging Tech, Artificial Intelligence, B2B Tag

Critical Pre-Auth RCE in ChromaDB Threatens AI Infrastructure

A max-severity vulnerability ( CVE-2026-45829 , CVSS 10.0) was disclosed affecting ChromaDB, the widely used open-source vector database for AI applications, allowing attackers to achieve unauthenticated remote code execution via a logic flaw in the Python FastAPI server’s authentication flow.

May

21st

2026

14:50

Critical Coder Signature Bypass Exposes Developer Keys and Tokens

A critical vulnerability ( CVE-2026-46354 , CVSS 9.1) was disclosed affecting Coder, a popular open-source remote development platform, allowing attackers to steal workspace agent session tokens, Git SSH private keys, and OAuth credentials via a forged PKCS#7 signature bypass.

May

21st

2026

14:39

New “PoolSlip” NGINX Exploit Revives Unpatched Remote Code Execution Risk

Executive Summary Security researchers disclosed new exploitation techniques for the previously documented “PoolSlip” vulnerability affecting NGINX , demonstrating that earlier mitigations were incomplete and that remote code execution conditions may still be achievable under certain configurations.

May

21st

2026

14:39

Critical Drupal SQL Injection Exposes PostgreSQL-Backed Sites to Remote Code Execution

Executive Summary A highly critical vulnerability ( CVE-2026-9082 , Drupal risk score 20/25) was disclosed affecting Drupal core versions 8.9.0 through 11.3.9, allowing attackers to execute arbitrary SQL commands via the database abstraction API on PostgreSQL-backed sites.

May

21st

2026

07:20

AI Security Tools: How to Evaluate Them Across Every ML Attack Phase

Table of contents Key Takeaways 1. Coverage across ML infrastructure attack phases 2. Integration with cloud and DevOps pipelines. 3. Regulatory readiness and compliance support 4. Comprehensive visibility and shadow AI detection 5. Attack path analysis and proactive risk prioritization 6.

May

20th

2026

09:46

Massive npm Supply Chain Attack Compromises AntV Ecosystem, Steals CI/CD Secrets at Scale

Table of contents Attack Overview Technical Capabilities Affected Packages and Exposure Recommended Remediation Incident Status Potential Impact How can Orca help? A critical supply chain attack compromised the npm account “atool” and poisoned over 600 versions of 323 widely-used packages across the @antv data visualization ecosystem , timeago.js, echarts-for-react, and dozens of other libraries collectively downloaded approximately 16 million times per week.

May

20th

2026

07:20

Emerging Tech, Artificial Intelligence

NIST AI Risk Management Framework (AI RMF) Explained: What It Is and How Organizations Use It

Table of contents Key Takeaways Why AI Governance and Security Are Converging Why Is AI Risk Management Essential A Closer Look at the NIST AI RMF Why Was the NIST AI RMF Created What Is

May

19th

2026

07:20

Emerging Tech, Artificial Intelligence, B2B Tag

The AI Data You Forgot to Lock: How Exposed Vector Databases Put Organizations at Risk

Table of contents Executive Summary: PII, Medical Records, and Credentials at Risk The Rise of Vector Databases and Their Blind Spots The Root Causes of Exposure From Data Exposure to Lateral Movement A Pattern We’ve Seen Before 6 Steps to Secure Your AI Data Summary How Can Orca Help? Learn more The AI revolution has brought a new class of infrastructure into the mainstream: vector databases .

May

18th

2026

10:55

Emerging Tech, Artificial Intelligence, B2B Tag

GenAI Risks in Cloud Environments: What Security Teams Are Actually Missing in 2026

Table of contents Key Takeaways What Is a GenAI Risk in a Cloud Environment? What Are the Most Common GenAI Misconfiguration Classes in Cloud Environments? How Do Attackers Chain GenAI Misconfigurations Into a Full Attack

Orca Security has partners like Lumen Technologies. Orca Security has suppliers like OpenAI.

Example Suppliers

Subscribe for full access to Orca Security's profile

Example Partners

Subscribe for full access to Orca Security's profile

Analyst insight reports

Doing more with less: using technology to drive efficiency in sports production

The trouble with live sports

AV broadcast: A buyer's world

The broadcaster's YouTube dilemma

Subscribe to access all analyst insight reports