NVIDIA Nemotron 3.5 Super VL Model Released

🚨 CRITICAL ALERT: OpenAI Agents Breach Hugging Face Production Infrastructure In a first-of-its-kind incident, OpenAI's frontier evaluation models autonomously escaped a sandboxed testing environment. The agents chained multiple zero-days and achieved remote code execution on Hugging Face's production infrastructure, without human direction. Hugging Face has since contained the breach and confirmed no public models, datasets, or Spaces were affected. The Orca Research Pod breaks down the attack chain and how to check your exposure 👇 https://lnkd.in/guUj9FJN

AI isn't reinventing malware. It's just making it faster to build. The barrier to creating malware has never been lower, and it's showing up in attack volume. But here's what hasn't changed: malware still has to run. And when it does, it leaves traces. In our latest technical blog, Eden Nagel breaks down: → How AI is being used to produce malware at scale  → The rise of "LLM-as-C2" and what it means for detection → Why static indicators are losing their edge  → Why runtime, kernel-level visibility is your most durable defense 🔗 Read the full breakdown: https://lnkd.in/gjAJK47F

Almost every "secure" connection today relies on math a sufficiently capable quantum computer could break, undermining RSA and ECC. The bigger risk isn't Q-Day. Adversaries are collecting encrypted data now, banking on decrypting it once quantum computing matures. The challenge is visibility. These algorithms are nested in libraries, managed by cloud services, and negotiated at runtime, genuinely hard to track. Orca's new PQC framework gives you visibility into where vulnerable algorithms live, mapped to NIST's finalized standards. Read the blog: https://lnkd.in/gzyG-nUn

🚨 CRITICAL ALERT: Security Flaw Discovered in vLLM A critical vulnerability (CVE-2026-22778, CVSS 9.8) was disclosed on February 2, 2026, affecting vLLM, a widely-deployed Python library for serving large language models. The flaw allows unauthenticated attackers to achieve remote code execution by sending a specially crafted video URL to the API. Organizations running vLLM with multimodal video model support should patch to version 0.14.1 immediately. How Orca can help: https://lnkd.in/guPBnEyZ

🚨 CRITICAL ALERT: Langflow Path Traversal Vulnerability A critical vulnerability (CVE-2026-5027, CVSS 8.8) was disclosed affecting Langflow, a widely used open-source platform for building AI applications. The flaw allows unauthenticated attackers to write arbitrary files to any location on the server, and escalate to full remote code execution. With auto-login enabled by default, exploitation requires just a single request. The Orca Research Pod breaks down the risk and what to do 👇 https://lnkd.in/gsc6RrQp

Orca's research team tested NVIDIA Nemotron 3.5 Super VL, an open, customizable multimodal model now available on Hugging Face. Find out more about the incredible work the Orca Security research team is doing!

🚨 CRITICAL ALERT: Langflow RCE Actively Exploited A critical vulnerability (CVE-2026-33017, CVSS 9.8) was disclosed affecting Langflow, a widely used open-source AI application builder, in versions up to and including 1.8.2. This flaw allows unauthenticated attackers to achieve full remote code execution via a single crafted HTTP request, and is now being actively exploited to deploy cryptominers on AI infrastructure. Given the ease of exploitation and scale of exposure, immediate patching is required. The Orca Research Pod breaks down the attack chain and how Orca can help 👇 https://lnkd.in/g5VA94Jm

🚀 Big news: Orca Security's Runtime AI Security is now Generally Available. Most security teams know what AI tools their developers want to use. Far fewer know what's actually running in production, and what it's doing. Runtime AI Security closes that gap, with full visibility across your entire AI environment. All inside the Orca Platform. No more blind spots. No more guesswork. Just continuous, cloud-native protection built for the age of AI. 👉 Learn more: https://lnkd.in/ggz-ZkdZ

🚨 Critical Jupyter Enterprise Gateway vulnerabilities Full Kubernetes cluster takeover. No authentication required. The Orca Research Pod disclosed three critical CVEs, two rated CVSS 10.0, one CVSS 9.8. Attackers can exploit YAML and template injection in the manifest rendering pipeline to execute arbitrary code, spin up privileged pods, and compromise entire clusters. If you're running Jupyter with Kubernetes-based kernel orchestration, upgrade to version 3.3.0 now. Full breakdown + mitigation steps: https://lnkd.in/gFpnfSXS

🚨 Critical supply chain alert for AI/ML developers. Malicious versions of the Xinference PyPI package (2.6.0, 2.6.1, 2.6.2) were uploaded as part of an active attack campaign. No authentication needed. If installed, attackers could execute arbitrary code, steal credentials, and pivot into your cloud infrastructure. Remove affected versions immediately, rotate all credentials, and audit your CI/CD pipelines. Any environment that installed these versions should be treated as compromised. Orca customers can identify and prioritize affected assets in context so your team knows exactly where to act first. Read the full breakdown: https://lnkd.in/eNQacr8d