Orca Research Pod

Orca Security 'O' logomark
A stylized graphic of a container labeled as "react" and "next.js" with "Access Denied" overlayed on top
Featured

Additional React and Next.js RSC Vulnerabilities Lead to Denial-of-Service and Source Code Disclosure

Following the previously disclosed React2Shell remote code execution vulnerabilities (React: CVE-2025-55182, Next.js: CVE-2025-66478, CVSS 10.0), additional security issues were identified in React Server Components (RSC) during post-patch analysis.  Three new vulnerabilities were disclosed: These issues do not introduce a new RCE vector, but they do require an additional upgrade, even in environments that already patched …

  • December 15, 2025
  • By Roi Nisimi

Latest

All Latest

Explore

Discovered Vulnerabilities

Image of a red container with clouds

New runC Vulnerabilities Expose Docker and Kubernetes to Container Escape Attacks

This week, three new high-severity vulnerabilities were revealed in runC, the fundamental runtime technology used by most container platforms. This impacts major systems such as Docker, containerd, Kubernetes, and virtually all managed Kubernetes services offered by major cloud providers. These vulnerabilities combined allow for a container escape, where a malicious factor can break out of …

  • November 10, 2025
  • By Shir Sadon
A stylized graphic of the word CVE Alert next to a broken cog

CVE-2025-59287 Explained: Critical WSUS RCE Vulnerability Actively Exploited

  • October 26, 2025
A stylized graphic of a pull request from GitHub with a hole in it and data leaking out

pull_request_nightmare Part 2: Exploiting GitHub Actions for RCE and Supply Chain

  • September 30, 2025
A stylized graphic showing a pull request window with malicious code

pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks

  • September 24, 2025
A stylized graphic of floating packages in a dark cloud background

Massive npm Malware Campaign Infects Popular Packages, @ctrl/tinycolor Affected

  • September 16, 2025
All Discovered Vulnerabilities

‘Orca Watch’ Series

All ‘Orca Watch’ Series

Technical Deep Dives

All Technical Deep Dives

Thought Leadership

All Thought Leadership

In the News

All In the News

2025 State of Cloud Security Report: Hunting threats in the age of relentless risk

Get the report