F5 Labs threat research
In depth threat research, data driven vulnerability analyses, and security intelligence provided by the F5 threat research team.
Featured Blog Posts
Cloud Takeover: Mass Scanning for Exposed Vite Endpoints (CVE-2026-39364)
Sensor Intel Series: September 2026 CVE Trends
By Adam Metcalfe-Pearce
Capability Is Closing the Open-Closed Gap; Security Is Not
A competitive open-weight model, Claude Fable, and Jade Puffer.
By Lee Ennis
Chinese Open-weight AI Models: Cybersecurity Risks and Rewards
Chinese models show variation from month to month, highlighting the uncertain and unstable nature of their security posture
By F5 Labs StaffF5 Labs threat research Blog posts
(360)
2025 Cybersecurity Predictions | F5 Labs
Cybersecurity predictions seem to fall into one of two buckets: they are either utterly wild with the deliberate aim of courting some attention from the media, or they seem overly safe and almost b...
BGP, DNS, and the Fragility of our Critical Systems | F5 Labs
DNS is better known, but some recent high-profile outages are a reminder that Border Gateway Protocol (BGP) failures can take sites down too. ... Update, June 22, 2022: In light of the root cause a...
Tips and Tricks for Rolling Out Multi-Factor Authentication | F5 Labs
Evaluate your needs, prioritize apps, implement with users in mind, but most of all, stop waiting and just get started. ... The security industry is quick to point out the ineffectiveness of passwo...
Fallacy Failure Attack | F5 Labs
This month brings critical findings about AI security vulnerabilities as the industry enters what many are calling the "zero-click era" of AI attacks. ... We're witnessing a fundamental shift where...
Azure-Hosted Scanning Cluster Launches WordPress Webshell Discovery Campaign | F5 Labs
Just as we continually analyze the threat landscape, we also look to broaden and improve our telemetry to provide the best possible insights from our datasets. ... With this, in this article we are...
Delving Into the SparkRAT Remote Access Tool | F5 Labs
Table of Contents ... The Sensor Intel Series is created in partnership with Efflux, who maintains a globally distributed network of sensors from which we derive attack telemetry. ... Additional in...
More Mozilla User-Agents, Please: a Deep Dive into an Inadvertent Disclosure Scanner | F5 Labs
Table of Contents ... The Sensor Intel Series is created in partnership with Efflux, who maintains a globally distributed network of sensors from which we derive attack telemetry. ... Additional in...
Continued Scanning for CVE-2023-1389 | F5 Labs
Table of Contents ... The Sensor Intel Series is created in partnership with Efflux, who maintains a globally distributed network of sensors from which we derive attack telemetry. ... Additional in...
F5 Labs Top CWEs & OWASP Top Ten Analysis | F5 Labs
We expand our view to include CWE and OWASP, and we also examine the latest overall trends for June 2025. ... Table of Contents ... The Sensor Intel Series is created in partnership with Efflux, wh...
Drupal Core CVE-2026-9082 Active Exploitation Confirmed Within Days of Disclosure | F5 Labs
Published on May 20, 2026, it was added to the CISA Known Exploited Vulnerabilities (KEV) catalog the same month with a remediation deadline of May 27. ... The vulnerability affects Drupal Core ver...
2025 Advanced Persistent Bots Report | F5 Labs
Uncovering the true scale of persistent bot activity, and the advanced techniques that bot operators use in order to remain hidden from bot defenses. ... While mobile endpoints see higher level of ...
Why Critical MongoDB Library Flaws Won't See Mass Exploitation | F5 Labs
The recently published CVE-2025-23061 1 , and its predecessor CVE-2024-53900 2 , discloses a vulnerability in the Mongoose MongoDB client library. ... This CVE enables Remote Code Execution on Node...
When AI Gets Bullied: How Agentic Attacks Are Replaying Human Social Engineering | F5 Labs
December closed out 2025 with a clear signal that AI risk, capability, and governance are evolving faster than ever. ... Updated CASI and ARS leaderboards showed a notable shift at the top, with GP...
2026 State of PQC on the Web | F5 Labs
As the threat of cryptographically relevant quantum computers (CRQCs) moves from theoretical physics to a tangible operational risk, organizations worldwide are scrambling to secure their networks.
Analyzing React2Shell Threat Actors | F5 Labs
Table of Contents ... The Sensor Intel Series is created in partnership with Efflux, who maintains a globally distributed network of sensors from which we derive attack telemetry. ... Introduction
CVE-2024-44000 (LiteSpeed Cache Account Takeover) Ranks in June’s Top Threats | F5 Labs
Introduction ... June 2026 marked a significant escalation in hostile internet activity observed by honeynet sensors, with overall attack volume increasing by 55.5% month over month after three con...
Canary Exploit Tool for CVE-2025-30065 Apache Parquet Avro Vulnerability | F5 Labs
Investigating a schema parsing concern in the parquet-avro module of Apache Parquet Java. ... Want a quick redux of the canary exploit tool? ... On April 1st, 2025, CVE-2025-30065 was published, al...
Chinese Open-weight AI Models: Cybersecurity Risks and Rewards | F5 Labs
Chinese models show variation from month to month, highlighting the uncertain and unstable nature of their security posture ... In the complex and continually evolving LLM market, organizations hav...