F5 Released Security Updates Covering Multiple Products Following Recent Hack

F5 Networks, a leading provider of application security and delivery solutions, has disclosed a significant security breach involving a nation-state threat actor, prompting the release of critical updates for its core products.

Detected in August 2025, the incident exposed internal systems to prolonged unauthorized access, leading to the theft of BIG-IP source code and undisclosed vulnerability data.

In response, F5 has rolled out patches across BIG-IP, F5OS, BIG-IQ, APM clients, and BIG-IP Next for Kubernetes to safeguard customers amid heightened risks.

The intrusion came to light on August 9, 2025, when F5 identified suspicious activity within its BIG-IP product development environment and engineering knowledge platforms.

The advanced adversary maintained persistent access, exfiltrating sensitive files including portions of source code and configuration details for a limited number of customers.

No evidence suggests alterations to the software supply chain or impacts on production systems, but the stolen intellectual property raises concerns about potential zero-day exploits targeting unpatched deployments.

F5 swiftly contained the threat through comprehensive measures, halting further unauthorized actions and confirming no ongoing intrusions.

The company enlisted top cybersecurity firms like CrowdStrike and Mandiant for investigation support, while collaborating with law enforcement and government agencies.

This proactive stance aligns with F5’s vulnerability management practices, now intensified to bolster enterprise and product security postures.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) responded with Emergency Directive ED 26-01, mandating federal agencies to patch and isolate affected F5 assets immediately.

F5 Security Updates

On October 15, 2025, F5 published its Quarterly Security Notification, detailing 44 vulnerabilities addressed in the latest releases, many tied to the breach’s implications.

High-severity CVEs dominate, with scores up to 8.7 under CVSS v3.1, affecting components like SCP/SFTP in BIG-IP (CVE-2025-53868) and F5OS platforms (CVE-2025-61955).

These flaws enable potential denial-of-service, privilege escalation, and remote code execution, particularly in appliance modes where risks escalate.

Medium and low-risk issues include iControl REST vulnerabilities (CVE-2025-59481) and configuration utility exposures, fixed in versions such as BIG-IP 17.5.1.3 and F5OS-C 1.8.2.

High Severity Vulnerabilities

Medium Severity Vulnerabilities

Low Severity Vulnerabilities

Security Exposures

BIG-IP Next for Kubernetes receives targeted hotfixes, like 2.1.0 EHF-14, to mitigate TMM and SSL/TLS weaknesses. Security exposures in BIG-IP AFM are also resolved, emphasizing the need for swift upgrades across all supported versions.

F5 stresses that while no active exploitation of undisclosed flaws is known, updating is essential to prevent lateral movement and data exfiltration in customer networks.

Customers should prioritize applying these updates, enabling event streaming to SIEM tools, and isolating management interfaces from public access.

Decommissioning end-of-life products further reduces exposure. F5’s transparency underscores the evolving nation-state threats, where stolen code could fuel sophisticated attacks on critical infrastructure.

By patching promptly, organizations can maintain robust defenses against this and future incidents. For full details, refer to F5’s official notification.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post F5 Released Security Updates Covering Multiple Products Following Recent Hack appeared first on Cyber Security News.

Source link