<?xml version="1.0" encoding="UTF-8"?>
<opml version="2.0">
  <head>
    <title>ORKL Library Source Feeds</title>
    <dateCreated>Wed, 08 Jul 2026 00:00:00 GMT</dateCreated>
    <!-- Group 1: sites with >=40 references in https://archive.orkl.eu/library.json (mirrors and doc hosts excluded).
         Group 2: additional security vendors / research teams (incl. the 25-40 reference tier).
         Group 3: national CERTs / CSIRTs and CERT-adjacent orgs.
         All feeds verified returning RSS/Atom with recent items on 2026-07-08; stale (>6 months), empty,
         and PR/product-only feeds removed after content review.
         Caveats: ACSC (cyber.gov.au) and CCB Belgium sit behind Akamai bot protection - they work in
         browsers/Feedly but may 403 plain server-side fetchers. -->
  </head>
  <body>
    <outline text="ORKL Top Sources" title="ORKL Top Sources">
      <outline text="BleepingComputer" title="BleepingComputer" type="rss" xmlUrl="https://www.bleepingcomputer.com/feed/" htmlUrl="https://www.bleepingcomputer.com/"/>
      <outline text="Unit 42 (Palo Alto Networks)" title="Unit 42 (Palo Alto Networks)" type="rss" xmlUrl="https://unit42.paloaltonetworks.com/feed/" htmlUrl="https://unit42.paloaltonetworks.com/"/>
      <outline text="Securelist (Kaspersky)" title="Securelist (Kaspersky)" type="rss" xmlUrl="https://securelist.com/feed/" htmlUrl="https://securelist.com/"/>
      <outline text="WeLiveSecurity (ESET)" title="WeLiveSecurity (ESET)" type="rss" xmlUrl="https://www.welivesecurity.com/en/rss/feed/" htmlUrl="https://www.welivesecurity.com/"/>
      <outline text="CISA Advisories" title="CISA Advisories" type="rss" xmlUrl="https://www.cisa.gov/cybersecurity-advisories/all.xml" htmlUrl="https://www.cisa.gov/news-events/cybersecurity-advisories"/>
      <outline text="Cisco Talos" title="Cisco Talos" type="rss" xmlUrl="https://blog.talosintelligence.com/rss/" htmlUrl="https://blog.talosintelligence.com/"/>
      <outline text="The Record" title="The Record" type="rss" xmlUrl="https://therecord.media/feed" htmlUrl="https://therecord.media/"/>
      <outline text="Google Threat Intelligence (Mandiant)" title="Google Threat Intelligence (Mandiant)" type="rss" xmlUrl="https://cloudblog.withgoogle.com/topics/threat-intelligence/rss/" htmlUrl="https://cloud.google.com/blog/topics/threat-intelligence/"/>
      <outline text="Check Point Research" title="Check Point Research" type="rss" xmlUrl="https://research.checkpoint.com/feed/" htmlUrl="https://research.checkpoint.com/"/>
      <outline text="Proofpoint Threat Insight" title="Proofpoint Threat Insight" type="rss" xmlUrl="https://www.proofpoint.com/us/rss.xml" htmlUrl="https://www.proofpoint.com/us/blog/threat-insight"/>
      <outline text="Malwarebytes Labs" title="Malwarebytes Labs" type="rss" xmlUrl="https://www.malwarebytes.com/blog/feed/index.xml" htmlUrl="https://www.malwarebytes.com/blog"/>
      <outline text="Microsoft Threat Intelligence" title="Microsoft Threat Intelligence" type="rss" xmlUrl="https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/feed/" htmlUrl="https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/"/>
      <outline text="SentinelOne Labs" title="SentinelOne Labs" type="rss" xmlUrl="https://www.sentinelone.com/labs/feed/" htmlUrl="https://www.sentinelone.com/labs/"/>
      <outline text="AhnLab ASEC" title="AhnLab ASEC" type="rss" xmlUrl="https://asec.ahnlab.com/en/feed/" htmlUrl="https://asec.ahnlab.com/en/"/>
      <outline text="FortiGuard Labs Outbreak Alerts" title="FortiGuard Labs Outbreak Alerts" type="rss" xmlUrl="https://filestore.fortinet.com/fortiguard/rss/outbreakalert.xml" htmlUrl="https://www.fortiguard.com/outbreak-alert"/>
      <outline text="Zscaler ThreatLabz" title="Zscaler ThreatLabz" type="rss" xmlUrl="https://www.zscaler.com/blogs/feeds/security-research" htmlUrl="https://www.zscaler.com/blogs/security-research"/>
      <outline text="CrowdStrike Blog" title="CrowdStrike Blog" type="rss" xmlUrl="https://www.crowdstrike.com/blog/feed/" htmlUrl="https://www.crowdstrike.com/blog/"/>
      <outline text="Recorded Future" title="Recorded Future" type="rss" xmlUrl="https://www.recordedfuture.com/feed" htmlUrl="https://www.recordedfuture.com/blog"/>
      <outline text="Cyble" title="Cyble" type="rss" xmlUrl="https://cyble.com/feed/" htmlUrl="https://cyble.com/blog/"/>
      <outline text="Symantec Threat Intelligence (Broadcom)" title="Symantec Threat Intelligence (Broadcom)" type="rss" xmlUrl="https://www.security.com/rss/v1/blogs/rss.xml/221" htmlUrl="https://www.security.com/threat-intelligence"/>
      <outline text="The Hacker News" title="The Hacker News" type="rss" xmlUrl="https://feeds.feedburner.com/TheHackersNews" htmlUrl="https://thehackernews.com/"/>
      <outline text="Krebs on Security" title="Krebs on Security" type="rss" xmlUrl="https://krebsonsecurity.com/feed/" htmlUrl="https://krebsonsecurity.com/"/>
      <outline text="Bitdefender Labs" title="Bitdefender Labs" type="rss" xmlUrl="https://www.bitdefender.com/nuxt/api/en-us/rss/labs/" htmlUrl="https://www.bitdefender.com/en-us/blog/labs/"/>
      <outline text="SANS Internet Storm Center" title="SANS Internet Storm Center" type="rss" xmlUrl="https://isc.sans.edu/rssfeed_full.xml" htmlUrl="https://isc.sans.edu/"/>
      <outline text="Elastic Security Labs" title="Elastic Security Labs" type="rss" xmlUrl="https://www.elastic.co/security-labs/rss/feed.xml" htmlUrl="https://www.elastic.co/security-labs"/>
      <outline text="Trustwave SpiderLabs" title="Trustwave SpiderLabs" type="rss" xmlUrl="https://www.trustwave.com/en-us/rss/spiderlabs-blog/" htmlUrl="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/"/>
      <outline text="ID Ransomware Blog" title="ID Ransomware Blog" type="rss" xmlUrl="https://id-ransomware.blogspot.com/feeds/posts/default?alt=rss" htmlUrl="https://id-ransomware.blogspot.com/"/>
      <outline text="Group-IB Blog" title="Group-IB Blog" type="rss" xmlUrl="https://www.group-ib.com/blog/rss.xml" htmlUrl="https://www.group-ib.com/blog/"/>
      <outline text="DataBreaches.net" title="DataBreaches.net" type="rss" xmlUrl="https://databreaches.net/feed/" htmlUrl="https://databreaches.net/"/>
      <outline text="K7 Labs" title="K7 Labs" type="rss" xmlUrl="https://labs.k7computing.com/index.php/feed/" htmlUrl="https://labs.k7computing.com/"/>
      <outline text="The DFIR Report" title="The DFIR Report" type="rss" xmlUrl="https://thedfirreport.com/feed/" htmlUrl="https://thedfirreport.com/"/>
      <outline text="CERT-UA" title="CERT-UA" type="rss" xmlUrl="https://cert.gov.ua/api/articles/rss" htmlUrl="https://cert.gov.ua/"/>
      <outline text="ClearSky Security" title="ClearSky Security" type="rss" xmlUrl="https://www.clearskysec.com/feed/" htmlUrl="https://www.clearskysec.com/"/>
      <outline text="Avast Decoded (Gen Digital)" title="Avast Decoded (Gen Digital)" type="rss" xmlUrl="https://www.gendigital.com/blog/rss/v1/blogs/rss.xml/15299,15040,15041" htmlUrl="https://www.gendigital.com/blog/"/>
      <outline text="Dark Reading" title="Dark Reading" type="rss" xmlUrl="https://www.darkreading.com/rss.xml" htmlUrl="https://www.darkreading.com/"/>
      <outline text="G DATA Security Blog" title="G DATA Security Blog" type="rss" xmlUrl="https://feeds.feedblitz.com/GDataSecurityBlog-EN&amp;x=1" htmlUrl="https://www.gdatasoftware.com/blog"/>
      <outline text="JPCERT/CC Blog" title="JPCERT/CC Blog" type="rss" xmlUrl="https://blogs.jpcert.or.jp/en/atom.xml" htmlUrl="https://blogs.jpcert.or.jp/en/"/>
      <outline text="ThreatFabric" title="ThreatFabric" type="rss" xmlUrl="https://www.threatfabric.com/blogs/rss.xml" htmlUrl="https://www.threatfabric.com/blogs"/>
      <outline text="Red Canary" title="Red Canary" type="rss" xmlUrl="https://redcanary.com/feed/" htmlUrl="https://redcanary.com/blog/"/>
      <outline text="Citizen Lab" title="Citizen Lab" type="rss" xmlUrl="https://citizenlab.ca/feed/" htmlUrl="https://citizenlab.ca/"/>
      <outline text="SOCRadar" title="SOCRadar" type="rss" xmlUrl="https://socradar.io/feed/" htmlUrl="https://socradar.io/blog/"/>
    </outline>
    <outline text="Security Vendors &amp; Research" title="Security Vendors &amp; Research">
      <outline text="Akamai Security Blog" title="Akamai Security Blog" type="rss" xmlUrl="https://feeds.feedburner.com/akamai/blog/security" htmlUrl="https://www.akamai.com/blog/security"/>
      <outline text="ANY.RUN Blog" title="ANY.RUN Blog" type="rss" xmlUrl="https://any.run/cybersecurity-blog/feed/" htmlUrl="https://any.run/cybersecurity-blog/"/>
      <outline text="Arctic Wolf" title="Arctic Wolf" type="rss" xmlUrl="https://arcticwolf.com/feed/" htmlUrl="https://arcticwolf.com/resources/blog/"/>
      <outline text="Censys" title="Censys" type="rss" xmlUrl="https://censys.com/feed/" htmlUrl="https://censys.com/blog/"/>
      <outline text="Claroty Team82 Disclosures" title="Claroty Team82 Disclosures" type="rss" xmlUrl="https://claroty.com/team82/disclosure-dashboard/feed" htmlUrl="https://claroty.com/team82"/>
      <outline text="Cloudflare Security Blog" title="Cloudflare Security Blog" type="rss" xmlUrl="https://blog.cloudflare.com/tag/security/rss/" htmlUrl="https://blog.cloudflare.com/tag/security/"/>
      <outline text="cocomelonc" title="cocomelonc" type="rss" xmlUrl="https://cocomelonc.github.io/feed.xml" htmlUrl="https://cocomelonc.github.io/"/>
      <outline text="Datadog Security Labs" title="Datadog Security Labs" type="rss" xmlUrl="https://securitylabs.datadoghq.com/rss/feed.xml" htmlUrl="https://securitylabs.datadoghq.com/"/>
      <outline text="DomainTools" title="DomainTools" type="rss" xmlUrl="https://www.domaintools.com/blog/rss.xml" htmlUrl="https://www.domaintools.com/company/blog/"/>
      <outline text="Flashpoint" title="Flashpoint" type="rss" xmlUrl="https://flashpoint.io/feed/" htmlUrl="https://flashpoint.io/blog/"/>
      <outline text="Google Project Zero" title="Google Project Zero" type="rss" xmlUrl="https://googleprojectzero.blogspot.com/feeds/posts/default" htmlUrl="https://googleprojectzero.blogspot.com/"/>
      <outline text="GreyNoise" title="GreyNoise" type="rss" xmlUrl="https://www.greynoise.io/blog/rss.xml" htmlUrl="https://www.greynoise.io/blog"/>
      <outline text="HP Wolf Security" title="HP Wolf Security" type="rss" xmlUrl="https://threatresearch.ext.hp.com/feed/" htmlUrl="https://threatresearch.ext.hp.com/"/>
      <outline text="Huntress" title="Huntress" type="rss" xmlUrl="https://www.huntress.com/blog/rss.xml" htmlUrl="https://www.huntress.com/blog"/>
      <outline text="Infoblox" title="Infoblox" type="rss" xmlUrl="https://blogs.infoblox.com/feed/" htmlUrl="https://blogs.infoblox.com/"/>
      <outline text="Kaspersky ICS-CERT" title="Kaspersky ICS-CERT" type="rss" xmlUrl="https://ics-cert.kaspersky.com/feed/" htmlUrl="https://ics-cert.kaspersky.com/"/>
      <outline text="Lab52" title="Lab52" type="rss" xmlUrl="https://lab52.io/blog/feed/" htmlUrl="https://lab52.io/blog/"/>
      <outline text="Objective-See" title="Objective-See" type="rss" xmlUrl="https://objective-see.org/rss.xml" htmlUrl="https://objective-see.org/blog.html"/>
      <outline text="PT SWARM (Positive Technologies)" title="PT SWARM (Positive Technologies)" type="rss" xmlUrl="https://swarm.ptsecurity.com/feed/" htmlUrl="https://swarm.ptsecurity.com/"/>
      <outline text="Rapid7 Blog" title="Rapid7 Blog" type="rss" xmlUrl="https://blog.rapid7.com/rss/" htmlUrl="https://www.rapid7.com/blog/"/>
      <outline text="ReversingLabs" title="ReversingLabs" type="rss" xmlUrl="https://www.reversinglabs.com/blog/rss.xml" htmlUrl="https://www.reversinglabs.com/blog"/>
      <outline text="Security Affairs" title="Security Affairs" type="rss" xmlUrl="https://securityaffairs.com/feed" htmlUrl="https://securityaffairs.com/"/>
      <outline text="Seqrite" title="Seqrite" type="rss" xmlUrl="https://www.seqrite.com/blog/feed/" htmlUrl="https://www.seqrite.com/blog/"/>
      <outline text="Silent Push" title="Silent Push" type="rss" xmlUrl="https://www.silentpush.com/feed/" htmlUrl="https://www.silentpush.com/blog/"/>
      <outline text="Sophos Blog (incl. X-Ops / Secureworks CTU)" title="Sophos Blog (incl. X-Ops / Secureworks CTU)" type="rss" xmlUrl="https://www.sophos.com/en-us/blog/feed" htmlUrl="https://www.sophos.com/en-us/blog"/>
      <outline text="SpecterOps" title="SpecterOps" type="rss" xmlUrl="https://specterops.io/feed/" htmlUrl="https://specterops.io/blog/"/>
      <outline text="Stairwell" title="Stairwell" type="rss" xmlUrl="https://stairwell.com/feed/" htmlUrl="https://stairwell.com/resources/"/>
      <outline text="Sucuri Blog" title="Sucuri Blog" type="rss" xmlUrl="https://blog.sucuri.net/feed" htmlUrl="https://blog.sucuri.net/"/>
      <outline text="Sysdig" title="Sysdig" type="rss" xmlUrl="https://sysdig.com/feed/" htmlUrl="https://sysdig.com/blog/"/>
      <outline text="Trail of Bits" title="Trail of Bits" type="rss" xmlUrl="https://blog.trailofbits.com/feed/" htmlUrl="https://blog.trailofbits.com/"/>
      <outline text="TrustedSec" title="TrustedSec" type="rss" xmlUrl="https://www.trustedsec.com/feed/" htmlUrl="https://www.trustedsec.com/blog"/>
      <outline text="VirusTotal Blog" title="VirusTotal Blog" type="rss" xmlUrl="https://blog.virustotal.com/feeds/posts/default?alt=rss" htmlUrl="https://blog.virustotal.com/"/>
      <outline text="VMRay" title="VMRay" type="rss" xmlUrl="https://www.vmray.com/feed/" htmlUrl="https://www.vmray.com/blog/"/>
      <outline text="Volexity" title="Volexity" type="rss" xmlUrl="https://www.volexity.com/feed/" htmlUrl="https://www.volexity.com/blog/"/>
      <outline text="watchTowr Labs" title="watchTowr Labs" type="rss" xmlUrl="https://labs.watchtowr.com/rss/" htmlUrl="https://labs.watchtowr.com/"/>
      <outline text="WithSecure Labs" title="WithSecure Labs" type="rss" xmlUrl="https://www.withsecure.com/en/feed/?post_type=lab_item" htmlUrl="https://www.withsecure.com/en/resources-hub/w-labs/"/>
      <outline text="Wordfence" title="Wordfence" type="rss" xmlUrl="https://www.wordfence.com/blog/feed/" htmlUrl="https://www.wordfence.com/blog/"/>
      <outline text="Zimperium" title="Zimperium" type="rss" xmlUrl="https://zimperium.com/blog/rss.xml" htmlUrl="https://www.zimperium.com/blog/"/>
    </outline>
    <outline text="National CERTs / CSIRTs" title="National CERTs / CSIRTs">
      <outline text="CERT Polska" title="CERT Polska" type="rss" xmlUrl="https://cert.pl/en/rss.xml" htmlUrl="https://cert.pl/en/"/>
      <outline text="CERT-EU Threat Intelligence" title="CERT-EU Threat Intelligence" type="rss" xmlUrl="https://cert.europa.eu/publications/threat-intelligence-rss" htmlUrl="https://cert.europa.eu/publications/threat-intelligence"/>
      <outline text="CERT-FR Alertes (ANSSI)" title="CERT-FR Alertes (ANSSI)" type="rss" xmlUrl="https://www.cert.ssi.gouv.fr/alerte/feed/" htmlUrl="https://www.cert.ssi.gouv.fr/alerte/"/>
      <outline text="CERT-FR Bulletins (ANSSI)" title="CERT-FR Bulletins (ANSSI)" type="rss" xmlUrl="https://www.cert.ssi.gouv.fr/actualite/feed/" htmlUrl="https://www.cert.ssi.gouv.fr/actualite/"/>
      <outline text="CERT-Bund BITS (BSI)" title="CERT-Bund BITS (BSI)" type="rss" xmlUrl="https://www.bsi.bund.de/SiteGlobals/Functions/RSSFeed/RSSNewsfeed/RSSNewsfeed_CSW.xml" htmlUrl="https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Technische-Sicherheitshinweise-und-Warnungen/technische-sicherheitshinweise-und-warnungen_node.html"/>
      <outline text="CERT-RO / DNSC" title="CERT-RO / DNSC" type="rss" xmlUrl="https://dnsc.ro/feed" htmlUrl="https://dnsc.ro/"/>
      <outline text="CERT-SE" title="CERT-SE" type="rss" xmlUrl="https://www.cert.se/feed.rss" htmlUrl="https://www.cert.se/"/>
      <outline text="CERT.at" title="CERT.at" type="rss" xmlUrl="https://www.cert.at/cert-at.de.all.rss_2.0.xml" htmlUrl="https://www.cert.at/"/>
      <outline text="CFCS Denmark (Samsik)" title="CFCS Denmark (Samsik)" type="rss" xmlUrl="https://samsik.dk/feed/" htmlUrl="https://samsik.dk/"/>
      <outline text="CSIRT Italia (ACN)" title="CSIRT Italia (ACN)" type="rss" xmlUrl="https://www.acn.gov.it/portale/feedrss/-/journal/rss/20119/723192" htmlUrl="https://www.acn.gov.it/portale/csirt-italia"/>
      <outline text="INCIBE-CERT Avisos (Spain)" title="INCIBE-CERT Avisos (Spain)" type="rss" xmlUrl="https://www.incibe.es/incibe-cert/alerta-temprana/avisos/feed" htmlUrl="https://www.incibe.es/en/incibe-cert/early-warning/security-advisories"/>
      <outline text="JPCERT/CC Alerts" title="JPCERT/CC Alerts" type="rss" xmlUrl="https://www.jpcert.or.jp/english/rss/jpcert-en.rdf" htmlUrl="https://www.jpcert.or.jp/english/"/>
      <outline text="NCSC Ireland Alerts" title="NCSC Ireland Alerts" type="rss" xmlUrl="https://www.ncsc.gov.ie/news/alerts.rss" htmlUrl="https://www.ncsc.gov.ie/news/"/>
      <outline text="NCSC Switzerland (BACS)" title="NCSC Switzerland (BACS)" type="rss" xmlUrl="https://www.newsd.admin.ch/newsd/feeds/rss?lang=en&amp;org-nr=1101" htmlUrl="https://www.ncsc.admin.ch/"/>
      <outline text="NCSC UK" title="NCSC UK" type="rss" xmlUrl="https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml" htmlUrl="https://www.ncsc.gov.uk/"/>
      <outline text="NCSC-FI (Finland)" title="NCSC-FI (Finland)" type="rss" xmlUrl="https://www.kyberturvallisuuskeskus.fi/feed/rss/en" htmlUrl="https://www.kyberturvallisuuskeskus.fi/en/"/>
      <outline text="NCSC-NL Nieuws" title="NCSC-NL Nieuws" type="rss" xmlUrl="https://feeds.ncsc.nl/nieuws.rss" htmlUrl="https://www.ncsc.nl/actueel/nieuws"/>
      <outline text="NSM Norway (vulnerability alerts)" title="NSM Norway (vulnerability alerts)" type="rss" xmlUrl="https://nsm.no/rss/sarbarhetsvarsler-fra-nsm/" htmlUrl="https://nsm.no/"/>
      <outline text="TWCERT/CC TVN (Taiwan)" title="TWCERT/CC TVN (Taiwan)" type="rss" xmlUrl="https://www.twcert.org.tw/tw/rss-132-1.xml" htmlUrl="https://www.twcert.org.tw/tw/"/>
    </outline>
  </body>
</opml>
