When a security vendor is breached, the risk lands on you as a customer. In the F5 case, the stolen files included some BIG-IP source code and notes on undisclosed flaws, and CISA warned this could help an actor build targeted exploits against devices customers run. The practical answer is to know your vendor-run edge devices, and who can reach them, before any notice arrives.
What did the F5 breach put at risk?
F5 says it learned on 9 August 2025 that a highly sophisticated nation-state threat actor had gained unauthorized access to some of its systems. The actor kept long-term, persistent access to certain systems, including the BIG-IP product development environment and the engineering knowledge management platform. Files taken included some BIG-IP source code and information about undisclosed BIG-IP vulnerabilities F5 was working on. The full record is on our F5 source code breach incident page.
There is no public attribution to a named group or country. F5 and CISA both describe the actor only as nation-state or nation-state affiliated, and the NCSC names no actor.
Some files from the knowledge management platform held configuration or implementation information for a small percentage of customers. F5 said it would contact affected customers as appropriate.
What did F5 say it did not find?
F5 said it was not aware of any undisclosed critical or remote code vulnerabilities, or of active exploitation of undisclosed F5 vulnerabilities. It also said it had no evidence that its software supply chain, source code or build and release pipelines were modified, and that independent reviews by outside firms validated that assessment. F5 found no evidence of access to its CRM, financial, support case management or iHealth systems. The UK NCSC said there was no indication that customer networks had been impacted via the F5 compromise.
These statements matter, but they describe what was known on 15 October 2025. A buyer should read them as a starting point for checks, not as a reason to wait.
Why does a vendor’s stolen source code become your problem?
The material taken is the kind an attacker can study at leisure. CISA says access to source code could give the actor a technical advantage to exploit F5 devices and software, and could allow static and dynamic analysis to find logic flaws and zero-day vulnerabilities and to build targeted exploits.
The devices in question sit at the edge of customer networks. CISA called the actor an imminent threat to federal networks using F5 devices and software.
How fast would you learn which vendor products you run and expose?
This is the question to put to your own team. F5 learned of the intrusion on 9 August 2025. On 12 September 2025 the US Department of Justice decided that delaying public disclosure was warranted under Item 1.05(c) of Form 8-K. F5 filed its 8-K, posted its customer notice and released updates on 15 October 2025, the same day CISA issued Emergency Directive 26-01.
From that day the clock was short. Federal agencies had to inventory all BIG-IP hardware and software instances, check whether any management interface was reachable from the internet, and apply the latest updates to key products by 22 October 2025.
- 9 August 2025F5 learns of the intrusionA nation-state threat actor had gained unauthorized access.
- 12 September 2025Disclosure delayThe US Department of Justice decides a delay is warranted.
- 15 October 2025Public noticeF5 files its 8-K and releases updates; CISA issues Emergency Directive 26-01.
- 22 October 2025First patch deadlineLatest updates for F5OS, TMOS, BIG-IQ and BNK/CNF.
- 31 October 2025Second patch deadlineRemaining F5 devices.
Customers outside government had no such order, but the same arithmetic applies. If your notice arrives on the day the clock starts, your inventory, patch testing and approval path must already exist.
Where could the chain have been caught?
At the vendor, the actor held long-term access to development and knowledge systems. F5 says it has since hardened its product development environment and strengthened monitoring of all software development platforms. A fair question to any supplier is whether those platforms are monitored for long-lived access today.
At the customer, the checks are on your side. CISA told agencies to check whether the management interface is reachable from the internet, and the NCSC advised keeping management interfaces off the internet and assessing for compromise if one is exposed. F5 recommended enabling BIG-IP event streaming to a SIEM and monitoring login attempts.
What should a buyer check now?
Each check below comes from a stated instruction or recommendation in the F5, CISA or NCSC material.
- Inventory every instanceCISA ordered agencies to inventory all BIG-IP hardware and software instances.
- Check management interfacesCISA and the NCSC focus on internet reachability; the NCSC says assess an exposed one for compromise.
- Confirm updates and checksumsCISA required the latest vendor updates by set dates; for BNK/CNF it also required validating F5’s published MD5 checksums first.
- Find end-of-support devicesCISA ordered public-facing ones disconnected; the NCSC advised replacing them.
- Send device logs to your SIEMF5 recommended enabling BIG-IP event streaming to a SIEM and monitoring login attempts.
- Ask what the vendor holds on youSome F5 knowledge platform files held customer configuration information; F5 said it would contact affected customers as appropriate.
The last item is the one most teams skip. If you shared configuration files with a supplier’s support team, ask what was shared and whether the supplier has contacted you.
Two linked pieces cover this from other angles: the Salt Typhoon telecom hacks and the cyber incidents of 2026.