Trust Center

Orca Security is aware of the critical PHP vulnerabilities disclosed on October 21, 2026, collectively known as PHP2Shell, and is actively assessing potential impact.

Orca Platform: Based on our assessment to date, we have not identified internet-facing PHP within the Orca platform’s production environments.

FedRAMP Environment: A review of the current system inventory and most recent vulnerability scans for our FedRAMP environment has not identified PHP within the FedRAMP authorization boundary.

Corporate website: Our public marketing website runs on a managed WordPress hosting provider, which manages the underlying PHP runtime and is applying vendor fixes. The site is also protected by web application firewall rules that address PHP2Shell exploitation patterns.

At this time, we have no indication that customer data or the Orca platform has been affected. We will update this notice in the event that this changes.

Orca Security has reviewed the recently disclosed Citrix NetScaler ADC and Gateway zero-day vulnerabilities and has determined that Orca is not impacted. Citrix NetScaler is not used anywhere in Orca's production environment, corporate network, or FedRAMP environment, so there is no exposure to these vulnerabilities. No action is required from Orca customers. We continue to monitor emerging threats and will update this notice if anything changes.

Orca Security is aware of the security incident disclosed by Vercel involving unauthorized access to certain internal Vercel systems.
We conducted an internal investigation and can confirm the following:

• Our use of Vercel is limited to a single-page application for internal stakeholders, which is actively being migrated off Vercel.
• We reviewed our Vercel environment for suspicious activity and found none.
• Vercel confirmed directly that our credentials and personal data were not identified as compromised.
• As a precaution, we verified that the malicious OAuth App ID associated with the broader incident was not present in our Google Workspace environment.

Status: No impact to Orca Security or our customers.

We will continue to monitor Vercel's Security Bulletin (link below) for further updates and will communicate any changes to this assessment if warranted.
https://vercel.com/kb/bulletin/vercel-april-2026-security-incident

On March 31, 2026, two malicious versions of the Axios npm package (v1.14.1 and v0.30.4) were published via a compromised maintainer account, deploying a cross-platform Remote Access Trojan to affected systems. We have reviewed our dependencies and confirmed that Orca Security does not use the affected versions. Our environments were not impacted by this incident.

We're aware of the recent security incidents affecting the Trivy vulnerability scanner (March 2026). We've thoroughly reviewed our systems and can confirm we were not impacted. Our Trivy version was not among those compromised, and we found no indicators of exposure in our pipelines or infrastructure. We will continue to monitor the situation closely.