Fortinet fortinet.com

Threat Predictions (2026) - Analyzes the acceleration of cybercrime and its industrialization, highlighting the increasing speed and scale of attacks. Key insights reveal that AI-driven autonomous agents and the convergence of fraud and cybercrime will drive unprecedented…

Fortinet fortinet.com

Data Security Report (2025) - Examines the current state of enterprise data protection and reveals that 77% of organizations experienced insider-related data loss over an 18-month period. Key findings indicate that 72% of companies lack visibility into how users interact with…

Forrester forrester.com

Iot Security Solutions Report (2025) - Evaluates the landscape of IoT security solutions for Q3 2025, categorizing top vendors like Nozomi Networks and Claroty into Leaders, Strong Performers, and Contenders. The report emphasizes that while asset discovery is foundational…

Forrester Research forrester.com

An advisory company that offers paid research, consulting, and event services specialized in market research for information technology.

Forescout forescout.com

Riskiest Devices (2025) - Analyzes millions of devices to identify the most vulnerable assets in enterprise networks, revealing that network equipment has overtaken endpoints as the riskiest IT category. Key findings highlight a 15% increase in industry-wide risk, the…

Forescout forescout.com

Threat Review (2025) - Analyzes the threat landscape of the first half of 2025, emphasizing the persistence of known vulnerabilities and the blurring distinction between hacktivist and state-sponsored actors. Key insights highlight that 47% of newly exploited vulnerabilities…

Fluid Attacks fluidattacks.com

State Of Attacks (2026) - Analyzes the state of cybersecurity and vulnerability management across diverse software development environments, documenting trends in risk exposure and remediation efficiency throughout 2025. Key findings reveal that while the vulnerability…

Flashpoint flashpoint.io

Global Threat Intelligence Report (2026) - Analyzes the evolving global threat landscape, focusing on the convergence of artificial intelligence, identity exploitation, and automated attack frameworks. Key findings reveal a 1,500 percent surge in illicit AI discussions…

The Forum of Incident Response and Security Teams (FIRST) first.org

Provides platforms, means and tools for incident responders to always find the right partner and to collaborate efficiently.

FINOS finos.org

State of Open Source in_Financial Services (2025) - Analyzes the current state of open source software adoption and strategic maturity within the global financial services sector. Key findings indicate that 87 percent of organizations now view open source as critical to their…

Infoblox financialpost.com

DNS Threat Landscape Report (2026) - Examines the escalating scale of industrialized cybercrime and automated threat infrastructures through telemetry analysis of trillions of DNS queries. Key findings reveal that 22 percent of over 120 million newly registered domains were…

FIDO Alliance fidoalliance.org

An open industry association with a focused mission: authentication standards to help reduce the world's over-reliance on passwords.

Fidelis fidelissecurity.com

AWS Security (2026) - Evaluates the critical security practices required to protect complex cloud environments as organizations scale their infrastructure into 2026. Key findings indicate that misconfigurations remain a primary driver of cloud breaches, with Verizon data…

FERMA ferma.eu

Demystifying Cyber Insurance (2025) - Analyzes the current state of the European cyber insurance market, identifying a transition from extreme volatility to a buyer-friendly environment characterized by softening rates and enhanced organizational resilience. Key findings…

FDIC federalreserve.gov

Cybersecurity and Resilience Report (2025) - Surveys the FDICs comprehensive strategy for strengthening both its internal cybersecurity and the resilience of the financial services sector. Key initiatives include significant policy updates in 2024, such as Directive 1.

FBI fbi.gov

IC3 Report (2025) - Examines the annual volume of cybercrime complaints, total financial losses, and prevalent fraud categories tracked by the Federal Bureau of Investigation Internet Crime Complaint Center. Key findings reveal that total losses surpassed $20 billion across…

FAIR Institute fairinstitute.org

State Of Cyber Risk Management Report (2026) - Examines the evolving landscape of corporate cyber risk oversight and provides a standardized framework for boards to integrate security into enterprise strategy. Documents the critical nature of this mandate by noting that global…

F5 f5.com

Advanced Persistent Bots Report (2025) - Examines the behavior of advanced persistent bots across 200 billion transactions, assessing the impact of mitigation on web and mobile API platforms. Analysis reveals that while overall automated attacks declined in most sectors, the…

F5 f5.com

Insider AI Threat Report (2025) - Examines the growing insider AI threat stemming from employees unmonitored use of artificial intelligence across organizational levels. Key findings reveal that 52% of employees are willing to use AI against company policy.

F5 f5.com

Office of the CTO Report Continuous API Sprawl (2026) - Examines the rapid expansion and economic impact of application programming interfaces across modern enterprise environments, detailing the primary factors driving continuous digital sprawl. Key findings reveal that the…

DNS Filter explore.dnsfilter.com

Annual Security Report (2026) - Analyzes the evolving landscape of DNS layer security and threat activity, documenting the increasing volume and sophistication of malicious traffic across global networks. Key findings reveal that threat activity grew by more than 30 percent…

Expel expel.com

Annual Threat Report (2026) - Investigates the evolving threat landscape across identity, endpoint, and cloud infrastructure to provide actionable insights for organizational defense strategies. Findings reveal that identity-based attacks remain the primary threat vector…

Europool europol.europa.eu

Internet Organized Crime Threat Assessment (2026) - Investigates the evolving landscape of internet organized crime, focusing on how artificial intelligence, encryption, and resilient infrastructure facilitate sophisticated cybercriminal operations across the European Union…

Remove evidence of malicious pull requests on GitHub x.com

Changing account's email to block-listed domain, automatically bans the account.

Europol - European Cybercrime Centre (EC3) europol.europa.eu

A strategic alliance focused on combating cybercrime within the European Union.

The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2) wiz.io

Vulnerabilities in AI-powered GitHub Actions. Syntactical permission checks that let attackers impersonate trusted apps and Dependabot Deputy Confusion Injection.

European Payments Council europeanpaymentscouncil.eu

Payments Threats and Fraud Trends Report (2025) - Investigates the evolving landscape of payment threats and fraud, emphasizing the critical role of artificial intelligence in scaling sophisticated cyberattacks against financial infrastructures. Findings indicate that social…

Millions of Secrets Exposed via Web Application Frontends web.archive.org

Millions of secrets exposed in web app frontends via JavaScript and debug pages.

Can you trust ChatGPT's package recommendations? vulcan.io

Exploit generative AI platforms' tendency to generate non-existent coding libraries to execute Dependecy Confusion.

Eset eset.com

Threat Report (2026) - Examines the emerging threats within the H1 2026 security landscape, focusing on the rapid expansion of agentic artificial intelligence attack surfaces and evolving social engineering tactics. Key findings reveal that security systems scanned nearly…

WordPress Plugin Confusion: How an update can get you pwned vavkamil.cz

Unclaimed WordPress plugins are vulnerable to takeover via the plugin directory.

Episki episki.com

State of GRC Trends Budgets and Benchmarks (2026) - Analyzes the current state of governance, risk, and compliance, highlighting the shift toward continuous assurance and multi-framework management within enterprise organizations. Key findings reveal that while compliance…

#redteam tip: want to discretely extract credentials from a CI/CD pipeline? twitter.com

Draft pull requests won't alert repository contributors, but will still trigger pipelines.

(The) Postman Carries Lots of Secrets trufflesecurity.com

Postman's public API network leaks thousands of secrets due to confusing UI, forks, and insufficient secret scanning.

Ensign ensigninfosecurity.com

Cyber Threat Landscape Report (2025) - Analyzes the cyber threat landscape in the Asia-Pacific region, highlighting trends and developments observed in 2025. Key findings include increased activity from state-sponsored groups, the persistence of ransomware, and attacks…

Anyone can Access Deleted and Private Repository Data on GitHub trufflesecurity.com

As long as it's part of a fork network.

Trojan Source trojansource.codes

Rather than inserting logical bugs, adversaries can attack the encoding of source code files to inject vulnerabilities.

ENISA enisa.europa.eu

Threat Landscape Report (2025) - Outlines the organizational scope and collaborative foundation of the 2025 Threat Landscape report, dedicated to enhancing the Union's infrastructure and digital security. Key contributors include EEAS STRATCOM, Europol EC3, and various…

Thousands of npm accounts use email addresses with expired domains therecord.media

Maintainer Email hijacking.

European Union Agency for Cybersecurity (ENISA) enisa.europa.eu

A European Union agency that contributes to EU cybersecurity policy, enhances trust in digital services, and supports incident response capabilities across Europe.

Hijacking GitHub runners to compromise the organization synacktiv.com

Registering a GitHub runner with the ubuntu-latest tag grants access to jobs originally designated for GitHub-provisioned runners.

Elastic elastic.co

State Of Detection Engineering (2025) - Analyzes the practice of detection engineering within Elastic Security, detailing their approach to rule development and enhancement. Key findings highlight the impact of real-world threat analysis, automated rule validation, and the…

Sourcegraph sourcegraph.com

A web-based code search and navigation tool for public repositories.

Why npm lockfiles can be a security blindspot for injecting malicious modules snyk.io

Malicious code can be injected into npm projects via lockfiles (package-lock.json or yarn.lock) because these large, machine-generated files are rarely reviewed thoroughly.

Elastic elastic.co

Global Threat Report (2025) - Analyzes the evolving landscape of cyber threats, highlighting a significant shift towards high-velocity attacks that weaponize trusted enterprise tools. Key insights reveal adversaries are prioritizing immediate execution over stealth, with…

Deep dive into Visual Studio Code extension security vulnerabilities snyk.io

VS Code extensions have vulnerabilities (command injection, path traversal, zip slip) that can compromise developer machines.

whoAMI: A cloud image name confusion attack securitylabs.datadoghq.com

Dependency Confusion using AWS AMIs.

Edgescan edgescan.com

Vulnerability Statistics Report (2026) - Analyzes the state of full stack security by evaluating millions of assets across diverse industries to identify critical vulnerabilities and remediation trends. Key findings reveal that 31.9 percent of discovered web application and API…

Keeping your GitHub Actions and workflows secure Part 2: Untrusted input securitylab.github.com

GitHub Actions command injection.

Durin durin.ai

Home Access Report (2025) - Surveys homeowner practices regarding smart lock and electronic keypad access code sharing and management. Key findings reveal that 78% of holiday travelers share codes, with 22% of homeowners never changing their access codes.