Publisher

orca.security

About orca.security on Clarity Today

Newest story built on orca.security reporting: Checkmarx finds malicious npm package function-flag still installable after 37,000 downloads (October 6, 2026). orca.security reporting informs the Security and Product desks, most often on Software Supply Chain Security, Vulnerability Management, and Edge and IoT Device Security. 12 of our current stories draw on it, the earliest from August 15, 2026.

Current stories

securityConfirmed15 publishers

Atlassian tells Data Center customers to pull exposed servers offline over a 9.3 file-read flaw

Atlassian disclosed a 9.3-rated flaw, CVE-2026-21589, that lets attackers with no login read known files in 8 self-hosted Data Center products. It wants internet-facing instances taken offline or cut off from outside access until they are upgraded or behind a blocking rule.

Publishers:bleepingcomputer.com blog.rapid7.com confluence.atlassian.com dev.to helpnetsecurity.com horizon3.ai imperva.com infosecurity-magazine.com labs.watchtowr.com orca.security scworld.com securityweek.com thecyberexpress.com thehackernews.com watchtowr.com

Perspective Coverage

15 publishers

Builder: Builder 24%
Operator: Operator 75%
Investor: Investor 1%

Reality

Evidence72
Adoption58
Hype gap−20
Incentives68
Confidence68

securityConfirmed3 publishers

Checkmarx finds malicious npm package function-flag still installable after 37,000 downloads

Checkmarx says function-flag, malicious since July 2025 and downloaded more than 37,000 times, is still on npm with no advisory flagging it. Advisory-based scanners have nothing to match, so finding it means checking lockfiles for the campaign's eight names.

Publishers:orca.security securityweek.com thehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 43%
Operator: Operator 50%
Investor: Investor 7%

Reality

Evidence70
Adoption20
Hype gap+15
Incentives55
Confidence68

securityConfirmed5 publishers

WordPress patched a comment flaw that uses an admin's session to plant a web shell

CVE-2026-93485 was fixed on September 17 in WordPress 7.1.1. An anonymous comment plants a script, an administrator opens the page, and the script uploads a plugin carrying a web shell. Affected versions go back to 4.7.

Publishers:bleepingcomputer.com helpnetsecurity.com orca.security securityaffairs.com thehackernews.com

Perspective Coverage

5 publishers

Builder: Builder 29%
Operator: Operator 64%
Investor: Investor 7%

Reality

Evidence62
Adoption: Not scored
Hype gap+20
Incentives45
Confidence58

securityConfirmed11 publishers

Third NetScaler zero-day hits SAML appliances already patched against the first two

Citrix confirmed CVE-2026-88779, a third exploited NetScaler zero-day, after appliances patched against the previous two began rebooting under attack. The vendor rates it denial of service, though logged payloads and a researcher's honeypot point toward code execution.

Publishers:bleepingcomputer.com cisa.gov cyberscoop.com infosecurity-magazine.com nakedsecurity.sophos.com orca.security scworld.com securityaffairs.com securityweek.com thehackernews.com therecord.media

Perspective Coverage

11 publishers

Builder: Builder 19%
Operator: Operator 68%
Investor: Investor 13%

Reality

Evidence78
Adoption: Not scored
Hype gap+20
Incentives50
Confidence70

securityConfirmed21 publishers

NetScaler attackers tunnel into internal networks with a new Python proxy

Mandiant and Google traced a September 2026 campaign exploiting NetScaler bug CVE-2026-88772, CVSS 9.5, to root on appliances with no login. From there the intruders drop web shells and a Python tunneler that reaches into victims' internal networks to steal credentials.

Publishers:bleepingcomputer.com blog.rapid7.com cert.europa.eu cisa.gov cyberdaily.au cyberscoop.com helpnetsecurity.com infosecurity-magazine.com itnews.com.au nakedsecurity.sophos.com ncsc.gov.uk networkworld.com orca.security scworld.com securityaffairs.com securityweek.com support.citrix.com thecyberexpress.com thehackernews.com therecord.media unit42.paloaltonetworks.com

Perspective Coverage

21 publishers

Builder: Builder 30%
Operator: Operator 62%
Investor: Investor 8%

Reality

Evidence88
Adoption82
Hype gap−8
Incentives58
Confidence85

securityConfirmed13 publishers

Exploitation evidence puts two Artifactory auth flaws and a ScreenConnect privilege bug in KEV

CISA added two JFrog Artifactory access-control flaws and one ConnectWise ScreenConnect privilege flaw to the Known Exploited Vulnerabilities catalog on 11 September, and by the catalog's own criteria published mitigation guidance already exists for each.

Publishers:bleepingcomputer.com blog.rapid7.com cisa.gov cisecurity.org cyberscoop.com darkreading.com horizon3.ai infosecurity-magazine.com orca.security scworld.com securityaffairs.com securityweek.com thehackernews.com

Perspective Coverage

13 publishers

Builder: Builder 23%
Operator: Operator 70%
Investor: Investor 7%

Reality

Evidence55
Adoption: Not scored
Hype gap−15
Incentives: Not scored
Confidence60

securityConfirmed2 publishers

CISA's KEV clock now runs on BOD 26-04, and your patch SLA cites the wrong directive

CISA has rewired the Known Exploited Vulnerabilities catalog to a binding directive issued June 10, 2026. The inclusion criteria are unchanged; the deadlines and the paperwork copying them are not.

Publishers:cisa.gov orca.security

Reality

Evidence70
Adoption40
Hype gap+10
Incentives40
Confidence65

securityConfirmed4 publishers

Two loops, one blocklist bypass: Elementor Pro's upload field becomes unauthenticated RCE

CVE-2026-32475 carries a CVSS of 9.0 and needs nothing more than a published form with a file upload field. Patchstack says version 4.2.2 fixes it.

Publishers:bleepingcomputer.com orca.security scworld.com thehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 34%
Operator: Operator 59%
Investor: Investor 7%

Reality

Evidence70
Adoption: Not scored
Hype gap+25
Incentives55
Confidence68

productOne report1 publisher

One unauthenticated GET request inflates install counts on an AI agent skills marketplace

Orca Security found four abuse paths in one of the biggest AI agent skills marketplaces. The install counter accepts unauthenticated requests, and the security audit only reruns once a skill gets popular.

Publishers:orca.security

Reality

Evidence48
Adoption22
Hype gap+18
Incentives65
Confidence55

securityOne report1 publisher

Orca's Service Graph connector claims the cloud half of the ServiceNow CMDB

A security scanner now owns the create, update and retire lifecycle for cloud configuration items. That moves the accuracy of IT's record of record onto whatever the scanner can reach.

Publishers:orca.security

Reality

Evidence30
Adoption15
Hype gap+40
Incentives85
Confidence55

securityOne report1 publisher

ECB orders every significant bank to file an AI cyber action plan by 31 October

Claudia Buch's 7 July letter gives supervised institutions 116 days to produce named owners, resourcing and timelines, on the ECB's stated view that AI has changed the speed of cyber risk rather than its substance.

Publishers:orca.security

Reality

Evidence58
Adoption: Not scored
Hype gap+20
Incentives82
Confidence55

securityOne report1 publisher

OWASP now names seventeen agentic threats, and the control unit is the whole run

Version 1.1 of the Agentic Security Initiative's guide enumerates T1 through T17, up from fifteen. Cite the version, and stop reviewing agents one tool call at a time.

Publishers:orca.security

Reality

Evidence52
Adoption: Not scored
Hype gap+12
Incentives74
Confidence48