The Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive warning that nation-state actors had compromised systems at F5, a major cybersecurity and networking company, including its BIG-IP source code, vulnerability data, and customer configurations. F5, whose products are used by 48 of the world’s top 50 corporations, revealed that the attackers had maintained persistent access to its network for an extended period, potentially for years. The stolen information could enable future supply-chain attacks, exploiting unpatched vulnerabilities. CISA called the breach an “imminent” and “unacceptable risk” to federal agency networks, directing immediate emergency action. F5 has issued patches and continues to investigate the scope of the intrusion.
