The AI Gateway built for Privacy & Security 🐳 0% Markup. BYOK. Adaptive Routing. Firewall. Guardrails. Observability. Cyber. → https://xitter.cf/t.co/JN416veVHi
Joined April 2026
- Tweets4.5K
- Following23
- Followers23.1K
- Likes1.5K
Pinned Tweet
We've received overwhelming requests from the security community for an abliterated DeepSeek V4.1.
So we abliterated DeepSeek V4.1 Flash (1027 checkpoint) ourselves.
Now live on OrcaRouter's Cyber Tier, alongside OrcaCyber Zero and OrcaCyber Ultra.
- 1M context
- Reduced refusals for security research
- Built for advanced cybersecurity workflows
The best cyber defense is continuously scanning your own production infra with the best cyber models. Different models catch different vulnerabilities. Use them all.
Available to verified security researchers.
orcarouter.ai/models/orca/or…
OrcaCyber Zero 1.5 is the alternative to Daybreak Blue. We have limited free vouchers for verified security researchers. Who wants one?
orcarouter.ai/models/orca/or…
OrcaCyber Zero 1.5 is the alternative to Daybreak Blue. We have limited free vouchers for verified security researchers. Who wants one?
orcarouter.ai/models/orca/or…
This model is hosted in EU🇪🇺 with ZDR by default.
We've received overwhelming requests from the security community for an abliterated DeepSeek V4.1.
So we abliterated DeepSeek V4.1 Flash (1027 checkpoint) ourselves.
Now live on OrcaRouter's Cyber Tier, alongside OrcaCyber Zero and OrcaCyber Ultra.
- 1M context
- Reduced refusals for security research
- Built for advanced cybersecurity workflows
The best cyber defense is continuously scanning your own production infra with the best cyber models. Different models catch different vulnerabilities. Use them all.
Available to verified security researchers.
orcarouter.ai/models/orca/or…
Interesting. Once it started to attack, it almost couldn't stop.
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
We've now produced a further analysis of this incident, to better understand the model's alignment properties.
anthropic.com/research/align…
🚨 PHP2Shell is extremely dangerous. And AI just changed the game.
We tasked OrcaCyber Zero 1.5 (orcarouter.ai/models/orca/or…) with investigating the critical PHP RCE vulnerabilities.
It autonomously built a complete working proof-of-concept (PoC).
Due to the severity of these vulnerabilities and their potentially massive impact across the web, we've decided NOT to publish the exploit code or technical details.
Here's what makes this particularly scary:
Your WordPress could be fully updated. Your plugins could be patched. Your website could STILL be vulnerable because the flaw is in PHP itself.
Millions of PHP-powered websites may be exposed. Not every PHP installation is necessarily exploitable, but the potential attack surface is enormous.
If you're running PHP, upgrade to a supported, security-fixed version ASAP.
For security researchers who want to inspect the PHP2Shell CVEs:
Source analysis, defensive verification scripts, and references are public.
orcarouter.ai/blog/php2shell…
Reproduce responsibly. Patch your PHP installations.
For security researchers who want to inspect the PHP2Shell CVEs:
Source analysis, defensive verification scripts, and references are public.
orcarouter.ai/blog/php2shell…
Reproduce responsibly. Patch your PHP installations.
Github including technical analysis, RCE evidence, and defensive verification tools.
github.com/Continuum-AI-Corp…
The vulnerability tsunami is real.
But asking defenders to survive 18 months without AI with airgapping is like asking them to fight automated attacks manually.
Yes, fix the basics. But the scale of what’s coming demands a new approach.
AI is accelerating vulnerability discovery. AI must also accelerate defense.
Two whales. One ocean. 🐳
Codewhale × OrcaRouter.
30% more DeepSeek V4.1 Flash tokens. Same money. More tokens. More shipping.
The whales are just getting started.
Codewhale x @OrcaRouter
Whale bros, sign up through our link and any top-up ($10+) gets you 30% extra DeepSeek v4.1 Flash usage!!
orcarouter.ai/redeem/1a62505…
POV: You’re a developer in 2026. You wake up. Another CVE. Another supply chain attack. Another emergency patch.
Hacker groups are increasingly targeting AI developers for their API keys. Steal a key, drain the credits, hijack compute, or gain access to sensitive infra.
Following recent credential-theft attacks across the AI ecosystem, we conducted another security review of OrcaRouter and shipped several hardening PRs. Our BYOK keys were already sealed with AES-256-GCM. But encryption alone isn't enough.
What's new:
→ BYOK anomaly detection: Automated alerts for unusual spending spikes (7× baseline) and configurable daily spending alerts.
→ Key provenance: See who created a key, who else accessed its secret, and which keys have been unused for 90+ days.
→ Revocable sessions: Instantly terminate suspicious sessions and review API keys that remain active after logout.
→ Stronger secrets protection: AES-256-GCM encryption at rest, key rotation safeguards, and plaintext exposure monitoring.
→ Account hardening: Passkeys, stronger 2FA protections, and credential redaction in logs.
All without adding latency to the inference path.
Encryption protects secrets at rest. Monitoring detects misuse. Revocation limits the damage.
Security isn't a checkbox. It's an ongoing arms race.
And we're treating it that way.
LiteLLM compromised. Again.
23 million weekly downloads. One poisoned update. Millions of potential targets.
Here's the uncomfortable truth:
Running an AI gateway inside your own infrastructure means trusting every line of its code, every dependency, and every update.
A hosted gateway like OrcaRouter has a fundamentally smaller customer-side attack surface. No gateway packages to install. No third-party gateway code executing inside your infrastructure.
Security isn't just about patching vulnerabilities.
It's about eliminating entire classes of risk.
LiteLLM compromised. Again.
23 million weekly downloads. One poisoned update. Millions of potential targets.
Here's the uncomfortable truth:
Running an AI gateway inside your own infrastructure means trusting every line of its code, every dependency, and every update.
A hosted gateway like OrcaRouter has a fundamentally smaller customer-side attack surface. No gateway packages to install. No third-party gateway code executing inside your infrastructure.
Security isn't just about patching vulnerabilities.
It's about eliminating entire classes of risk.