Dear all, good afternoon.
F5 Networks disclosed on Wednesday that it was the victim of a cybersecurity breach carried out by a highly sophisticated state-sponsored actor, resulting in the theft of proprietary BIG-IP source code and information regarding previously undisclosed vulnerabilities. The incident, discovered on August 9, 2025, allowed attackers to maintain long-term persistent access to the company’s product development environments and engineering knowledge management platforms.
Also on Wednesday, F5 released security patches for 44 vulnerabilities in its October 2025 Quarterly Security Notification, covering BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients. In parallel, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive ED 26-01, mandating that federal agencies apply security updates by October 22 for critical products and by October 31 for other F5 devices.
The exposure of the source code poses a significant risk, as it allows adversaries to identify and exploit vulnerabilities faster and more effectively. Although F5 stated there is no evidence of active exploitation of the stolen flaws so far, experts warn that the attackers’ insider knowledge substantially lowers the barrier to developing targeted exploits.
In this context, SEK recommends immediate actions for organizations using F5 products:
- Immediately apply all security updates provided in F5’s October 2025 Quarterly Security Notification, prioritizing internet-exposed devices.
- Conduct a full inventory of all F5 BIG-IP devices and virtual instances in the corporate environment, identifying versions and exposures.
- Assess whether management interfaces are directly accessible from the public internet and implement restrictive access controls as recommended by CISA.
- Immediately rotate credentials for all administrative accounts on F5 devices.
SEK remains available to assist clients in implementing these mitigation measures and strengthening their security posture in response to this emerging threat.
